[PATCH 1/2] mshtml: Fix a copy-paste error.

[Zebediah Figura]

Signed-off-by: Zebediah Figura 
---
 dlls/mshtml/dispex.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/mshtml/dispex.c b/dlls/mshtml/dispex.c
index e637f131d0..2033e90872 100644
--- a/dlls/mshtml/dispex.c
+++ b/dlls/mshtml/dispex.c
@@ -299,7 +299,7 @@ static void add_func_info(dispex_data_t *data, tid_t tid, const FUNCDESC *desc,
         if(!info->arg_types)
             return;
         info->arg_info = heap_alloc_zero(sizeof(*info->arg_info) * info->argc);
-        if(!info->arg_types)
+        if(!info->arg_info)
             return;

for(i=0; i < info->argc; i++)

[PATCH 2/2] mshtml: Avoid passing invalid memory to DispCallFunc().

[Zebediah Figura]

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=47222
Signed-off-by: Zebediah Figura 
---
 dlls/mshtml/dispex.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/dlls/mshtml/dispex.c b/dlls/mshtml/dispex.c
index 2033e90872..c536430d97 100644
--- a/dlls/mshtml/dispex.c
+++ b/dlls/mshtml/dispex.c
@@ -1129,6 +1129,7 @@ static HRESULT builtin_propput(DispatchEx *This, func_info_t *func, DISPPARAMS *
 static HRESULT invoke_builtin_function(DispatchEx *This, func_info_t *func, DISPPARAMS *dp, VARIANT *res, IServiceProvider *caller)
 {
     VARIANT arg_buf[MAX_ARGS], *arg_ptrs[MAX_ARGS], *arg, retv, ret_ref, vhres;
+    VARTYPE arg_types[MAX_ARGS];
     unsigned i, nconv = 0;
     IUnknown *iface;
     HRESULT hres;
@@ -1181,6 +1182,8 @@ static HRESULT invoke_builtin_function(DispatchEx *This, func_info_t *func, DISP
                 IDispatch_Release(V_DISPATCH(arg_ptrs[i]));
             V_DISPATCH(arg_ptrs[i]) = iface;
         }
+
+        arg_types[i] = func->arg_types[i];
     }

if(SUCCEEDED(hres)) {
@@ -1206,11 +1209,12 @@ static HRESULT invoke_builtin_function(DispatchEx *This, func_info_t *func, DISP
             default:
                 assert(0);
             }
+            arg_types[func->argc] = V_VT(&ret_ref);
         }

V_VT(&vhres) = VT_ERROR;
         hres = DispCallFunc(iface, func->call_vtbl_off*sizeof(void*), CC_STDCALL, VT_ERROR,
-                    func->argc + (func->prop_vt == VT_VOID ? 0 : 1), func->arg_types, arg_ptrs, &vhres);
+                    func->argc + (func->prop_vt == VT_VOID ? 0 : 1), arg_types, arg_ptrs, &vhres);
     }

while(nconv--)

[PATCH 2/2] mshtml: Avoid passing invalid memory to DispCallFunc().

[Marvin]

Hi,

While running your changed tests, I think I found new failures.
Being a bot and all I'm not very good at pattern recognition, so I might be
wrong, but could you please double-check?

Full results can be found at:
https://testbot.winehq.org/JobDetails.pl?Key=52477

Your paranoid android.

=== debian9 (32 bit report) ===

mshtml:
Unhandled exception: page fault on write access to 0x7e5a5386 in 32-bit code (0x7d141ff7).

Report errors:
mshtml:script crashed (c0000005)

=== debian9 (32 bit Chinese:China report) ===

mshtml:
Unhandled exception: page fault on write access to 0x7e5a5386 in 32-bit code (0x7d22fff7).

Report errors:
mshtml:script crashed (c0000005)

=== debian9 (32 bit WoW report) ===

mshtml:
Unhandled exception: page fault on write access to 0x7e5a5386 in 32-bit code (0x7d074ff7).

Report errors:
mshtml:script crashed (c0000005)

=== debian9 (64 bit WoW report) ===

mshtml:
Unhandled exception: page fault on write access to 0x7e5a5386 in 32-bit code (0x7d05cff7).

Report errors:
mshtml:script crashed (c0000005)