Gabriel Ivăncescu : mshtml: Fix document fragment's inner window leak.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: d38c1c1076d04089eedc47fa532ed8ec0e69a5ee
URL:    https://gitlab.winehq.org/wine/wine/-/commit/d38c1c1076d04089eedc47fa532ed8e...

Author: Gabriel Ivăncescu 
Date:   Wed Dec 14 22:06:07 2022 +0200

mshtml: Fix document fragment's inner window leak.

Document fragments own reference to the inner window, so it must be unlinked.

Signed-off-by: Gabriel Ivăncescu

---

dlls/mshtml/htmldoc.c | 35 ++++++++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/dlls/mshtml/htmldoc.c b/dlls/mshtml/htmldoc.c
index 49640cff9da..90c4706abee 100644
--- a/dlls/mshtml/htmldoc.c
+++ b/dlls/mshtml/htmldoc.c
@@ -5846,12 +5846,6 @@ void detach_document_node(HTMLDocumentNode *doc)
         doc->catmgr = NULL;
     }

-    if(!doc->dom_document && doc->window) {
-        /* document fragments own reference to inner window */
-        IHTMLWindow2_Release(&doc->window->base.IHTMLWindow2_iface);
-        doc->window = NULL;
-    }
-
     if(doc->browser) {
         list_remove(&doc->browser_entry);
         doc->browser = NULL;
@@ -5935,6 +5929,19 @@ static HRESULT HTMLDocumentFragment_clone(HTMLDOMNode *iface, nsIDOMNode *nsnode
     return S_OK;
 }

+static void HTMLDocumentFragment_unlink(HTMLDOMNode *iface)
+{
+    HTMLDocumentNode *This = impl_from_HTMLDOMNode(iface);
+
+    if(This->window) {
+        detach_document_node(This);
+
+        /* document fragments own reference to inner window */
+        IHTMLWindow2_Release(&This->window->base.IHTMLWindow2_iface);
+        This->window = NULL;
+    }
+}
+
 static inline HTMLDocumentNode *impl_from_DispatchEx(DispatchEx *iface)
 {
     return CONTAINING_RECORD(iface, HTMLDocumentNode, node.event_target.dispex);
@@ -6134,7 +6141,21 @@ static const NodeImplVtbl HTMLDocumentFragmentImplVtbl = {
     HTMLDocumentNode_QI,
     HTMLDocumentNode_destructor,
     HTMLDocumentNode_cpc,
-    HTMLDocumentFragment_clone
+    HTMLDocumentFragment_clone,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    HTMLDocumentFragment_unlink
 };

static const tid_t HTMLDocumentNode_iface_tids[] = {