Re: [PATCH v2 0/7] MR10688: msxml3: Improvements to setAttribute().

[Bernhard Übelacker (＠bernhardu)]

Hello Nikolay, I just wanted to forward a note that some of the recent msxml3 changes may started causing following ASan findings. Unfortunately in the past I was carrying the patch from !9279, but dropped it as it stopped to apply to current git. Therefore I currently cannot say if that is a new issue or if it is caused by recent patches.

Since [this gitlab run](https://gitlab.winehq.org/bernhardu/wine/-/jobs/253410#L3065) ASan gets triggered.
This run was based on top of [1b13526a5f](https://gitlab.winehq.org/wine/wine/-/commits/1b13526a5fcfa55de602b71ed9365c...).

<details>

<summary>ASan details</summary>

```
==msxml3_test.exe==1616==ERROR: AddressSanitizer: heap-use-after-free on address 0x101f4050e318 at pc 0x6ffff922e8e9 bp 0x7ffffe1ff820 sp 0x7ffffe1ff868
READ of size 8 at 0x101f4050e318 thread T0
    #0 0x6ffff922e8e8 in domnode_drop_refs /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1247:15
    #1 0x6ffff922e7d8 in domnode_release /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1385:11
    #2 0x6ffff91eea23 in domdoc_Release /builds/bernhardu/wine/build64/../dlls/msxml3/domdoc.c:449:9
    #3 0x00014007a586 in IXMLDOMDocument_Release /builds/bernhardu/wine/build64/include/msxml.h:1584:12
    #4 0x00014003bf0f in test_put_nodeTypedValue /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:9047:5
    #5 0x00014000114b in func_domdoc /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:16907:5
    #6 0x0001400eab42 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
    #7 0x0001400ea54b in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
    #8 0x0001400ec7da in mainCRTStartup /builds/bernhardu/wine/build64/../dlls/msvcrt/crt_main.c:70:11
    #9 0x6fffffc37b94 in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x178027b94)
    #10 0x6fffffdc0be6 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x170050be6)
0x101f4050e318 is located 104 bytes inside of 176-byte region [0x101f4050e2b0,0x101f4050e360)
freed by thread T0 here:
    #0 0x6ffffe82d861 in free /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:78:3
    #1 0x6ffff922def4 in domnode_destroy_tree /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1378:5
    #2 0x6ffff922e7f8 in domnode_release /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1387:9
    #3 0x6ffff91fcefa in domelem_Release /builds/bernhardu/wine/build64/../dlls/msxml3/element.c:115:9
    #4 0x00014007a7e6 in IXMLDOMElement_Release /builds/bernhardu/wine/build64/include/msxml.h:3969:12
    #5 0x00014003bf06 in test_put_nodeTypedValue /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:9046:5
    #6 0x00014000114b in func_domdoc /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:16907:5
    #7 0x0001400eab42 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
    #8 0x0001400ea54b in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
    #9 0x0001400ec7da in mainCRTStartup /builds/bernhardu/wine/build64/../dlls/msvcrt/crt_main.c:70:11
    #10 0x6fffffc37b94 in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x178027b94)
    #11 0x6fffffdc0be6 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x170050be6)
previously allocated by thread T0 here:
    #0 0x6ffffe82da86 in calloc /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:98:3
    #1 0x6ffff922c969 in domnode_create /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1053:20
    #2 0x6ffff91edd7c in dom_document_create /builds/bernhardu/wine/build64/../dlls/msxml3/domdoc.c:2536:21
    #3 0x6ffff9209586 in DOMClassFactory_CreateInstance /builds/bernhardu/wine/build64/../dlls/msxml3/factory.c:246:9
    #4 0x6ffffcc31b07 in IClassFactory_CreateInstance /builds/bernhardu/wine/build64/include/unknwn.h:248:12
    #5 0x6ffffcc30f29 in CoCreateInstanceEx /builds/bernhardu/wine/build64/../dlls/combase/combase.c:1947:10
    #6 0x6ffffcc30526 in CoCreateInstance /builds/bernhardu/wine/build64/../dlls/combase/combase.c:1736:10
    #7 0x00014007a1d9 in _create_object /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:1207:10
    #8 0x00014003a1f5 in test_put_nodeTypedValue /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:8860:11
    #9 0x00014000114b in func_domdoc /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:16907:5
    #10 0x0001400eab42 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
    #11 0x0001400ea54b in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
    #12 0x0001400ec7da in mainCRTStartup /builds/bernhardu/wine/build64/../dlls/msvcrt/crt_main.c:70:11
    #13 0x6fffffc37b94 in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x178027b94)
    #14 0x6fffffdc0be6 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x170050be6)
SUMMARY: AddressSanitizer: heap-use-after-free /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1247:15 in domnode_drop_refs
```

</details>

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10688#note_137020