[PATCH 05/14] mshtml: Don't remove non-string builtin props when removing an attribute.

[Gabriel Ivăncescu]

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/dispex.c              | 18 +++++++++++++++++-
 dlls/mshtml/tests/documentmode.js |  7 ++-----
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/dlls/mshtml/dispex.c b/dlls/mshtml/dispex.c
index d10064e..79ebc78 100644
--- a/dlls/mshtml/dispex.c
+++ b/dlls/mshtml/dispex.c
@@ -1412,6 +1412,22 @@ static HRESULT invoke_builtin_prop(DispatchEx *This, DISPID id, LCID lcid, WORD
     return hres;
 }

+static BOOL is_string_builtin(DispatchEx *This, func_info_t *func)
+{
+    BOOL ret = FALSE;
+    VARIANT var;
+
+    if(func->prop_vt == VT_BSTR)
+        return TRUE;
+    if(func->prop_vt != VT_VARIANT)
+        return FALSE;
+    if(SUCCEEDED(builtin_propget(This, func, NULL, &var))) {
+        ret = (V_VT(&var) == VT_BSTR);
+        VariantClear(&var);
+    }
+    return ret;
+}
+
 HRESULT remove_attribute(DispatchEx *This, DISPID id, VARIANT_BOOL *success)
 {
     switch(get_dispid_type(id)) {
@@ -1464,7 +1480,7 @@ HRESULT remove_attribute(DispatchEx *This, DISPID id, VARIANT_BOOL *success)
             return S_OK;
         }

-        if(!func->put_vtbl_off) {
+        if(!func->put_vtbl_off || !is_string_builtin(This, func)) {
             *success = VARIANT_FALSE;
             return S_OK;
         }
diff --git a/dlls/mshtml/tests/documentmode.js b/dlls/mshtml/tests/documentmode.js
index ce29f23..2bc0cbc 100644
--- a/dlls/mshtml/tests/documentmode.js
+++ b/dlls/mshtml/tests/documentmode.js
@@ -1129,9 +1129,8 @@ sync_test("elem_attr", function() {
     r = elem.getAttribute("onclick");
     ok(r === (v < 8 ? func : null), "onclick attr = " + r);
     r = elem.removeAttribute("onclick");
-    todo_wine_if(v < 8).
     ok(r === (v < 9 ? false : undefined), "removeAttribute returned " + r);
-    todo_wine_if(v < 9).
+    todo_wine_if(v === 8).
     ok(elem.onclick === (v != 8 ? func : null), "removed onclick = " + elem.onclick);

elem.onclick_test = func;
@@ -1175,13 +1174,11 @@ sync_test("elem_attr", function() {
     todo_wine_if(v >= 8 && v < 10).
     ok(r === (v < 8 ? arr : (v < 10 ? "[object]" : "3")), "ondblclick = " + r);
     r = elem.removeAttribute("ondblclick");
-    todo_wine_if(v < 8).
     ok(r === (v < 8 ? false : (v < 9 ? true : undefined)), "ondblclick removeAttribute returned " + r);
     if(v < 11)  /* IE11 returns an empty function, which we can't check */
-        todo_wine_if(v < 8).
         ok(elem.ondblclick === (v < 8 ? arr : null), "removed ondblclick = " + elem.ondblclick);
     r = Object.prototype.toString.call(elem.ondblclick);
-    todo_wine_if(v != 8).
+    todo_wine_if(v >= 9).
     ok(r === (v < 8 ? "[object Array]" : (v < 9 ? "[object Object]" : (v < 11 ? "[object Null]" : "[object Function]"))),
         "removed ondblclick Object.toString returned " + r);