[PATCH] msxml3: Fix value of 'fetched' in IEnumVariant_Next() for IXMLDOMSelection.

[Gijs Vermeulen]

From: Alexandre Abgrall

It must be the number of elements returned in 'var', as specified here:
https://docs.microsoft.com/en-us/windows/win32/api/oaidl/nf-oaidl-ienumvaria...

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=40430
Signed-off-by: Alexandre Abgrall 
Signed-off-by: Gijs Vermeulen 
---
 dlls/msxml3/selection.c    |   2 +-
 dlls/msxml3/tests/domdoc.c | 100 +++++++++++++++++++++++++++++++------
 2 files changed, 87 insertions(+), 15 deletions(-)

diff --git a/dlls/msxml3/selection.c b/dlls/msxml3/selection.c
index 31be4d8f10..3698d036d4 100644
--- a/dlls/msxml3/selection.c
+++ b/dlls/msxml3/selection.c
@@ -519,7 +519,7 @@ static HRESULT WINAPI enumvariant_Next(
         ret_count++;
     }

-    if (fetched) (*fetched)++;
+    if (fetched) *fetched = ret_count;

/* we need to advance one step more for some reason */
     if (ret_count)
diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c
index 7f3b42d840..d21b968ce3 100644
--- a/dlls/msxml3/tests/domdoc.c
+++ b/dlls/msxml3/tests/domdoc.c
@@ -9976,9 +9976,9 @@ static void test_selection(void)
     IXMLDOMNode *node;
     IDispatch *disp;
     VARIANT_BOOL b;
+    VARIANT v[4];
     HRESULT hr;
     DISPID did;
-    VARIANT v;
     BSTR name;
     ULONG ret;
     LONG len;
@@ -10148,10 +10148,10 @@ static void test_selection(void)
     EXPECT_HR(hr, S_OK);

/* no-op if zero count */
-    V_VT(&v) = VT_I2;
-    hr = IEnumVARIANT_Next(enum1, 0, &v, NULL);
+    V_VT(&v[0]) = VT_I2;
+    hr = IEnumVARIANT_Next(enum1, 0, &v[0], NULL);
     EXPECT_HR(hr, S_OK);
-    ok(V_VT(&v) == VT_I2, "got var type %d\n", V_VT(&v));
+    ok(V_VT(&v[0]) == VT_I2, "got var type %d\n", V_VT(&v[0]));

/* positive count, null array pointer */
     hr = IEnumVARIANT_Next(enum1, 1, NULL, NULL);
@@ -10162,19 +10162,19 @@ static void test_selection(void)
     EXPECT_HR(hr, E_INVALIDARG);
     ok(ret == 0, "got %d\n", ret);

-    V_VT(&v) = VT_I2;
-    hr = IEnumVARIANT_Next(enum1, 1, &v, NULL);
+    V_VT(&v[0]) = VT_I2;
+    hr = IEnumVARIANT_Next(enum1, 1, &v[0], NULL);
     EXPECT_HR(hr, S_OK);
-    ok(V_VT(&v) == VT_DISPATCH, "got var type %d\n", V_VT(&v));
+    ok(V_VT(&v[0]) == VT_DISPATCH, "got var type %d\n", V_VT(&v[0]));

-    hr = IDispatch_QueryInterface(V_DISPATCH(&v), &IID_IXMLDOMNode, (void**)&node);
+    hr = IDispatch_QueryInterface(V_DISPATCH(&v[0]), &IID_IXMLDOMNode, (void**)&node);
     EXPECT_HR(hr, S_OK);
     hr = IXMLDOMNode_get_nodeName(node, &name);
     EXPECT_HR(hr, S_OK);
     ok(!lstrcmpW(name, L"a"), "got node name %s\n", wine_dbgstr_w(name));
     SysFreeString(name);
     IXMLDOMNode_Release(node);
-    VariantClear(&v);
+    VariantClear(&v[0]);

/* list cursor is updated */
     hr = IXMLDOMSelection_nextNode(selection, &node);
@@ -10185,18 +10185,18 @@ static void test_selection(void)
     IXMLDOMNode_Release(node);
     SysFreeString(name);

-    V_VT(&v) = VT_I2;
-    hr = IEnumVARIANT_Next(enum1, 1, &v, NULL);
+    V_VT(&v[0]) = VT_I2;
+    hr = IEnumVARIANT_Next(enum1, 1, &v[0], NULL);
     EXPECT_HR(hr, S_OK);
-    ok(V_VT(&v) == VT_DISPATCH, "got var type %d\n", V_VT(&v));
-    hr = IDispatch_QueryInterface(V_DISPATCH(&v), &IID_IXMLDOMNode, (void**)&node);
+    ok(V_VT(&v[0]) == VT_DISPATCH, "got var type %d\n", V_VT(&v[0]));
+    hr = IDispatch_QueryInterface(V_DISPATCH(&v[0]), &IID_IXMLDOMNode, (void**)&node);
     EXPECT_HR(hr, S_OK);
     hr = IXMLDOMNode_get_nodeName(node, &name);
     EXPECT_HR(hr, S_OK);
     ok(!lstrcmpW(name, L"b"), "got node name %s\n", wine_dbgstr_w(name));
     SysFreeString(name);
     IXMLDOMNode_Release(node);
-    VariantClear(&v);
+    VariantClear(&v[0]);
     IEnumVARIANT_Release(enum1);

hr = IXMLDOMSelection_nextNode(selection, &node);
@@ -10207,6 +10207,78 @@ static void test_selection(void)
     IXMLDOMNode_Release(node);
     SysFreeString(name);

+    /* getting multiple elements */
+    enum1 = NULL;
+    hr = IXMLDOMSelection_get__newEnum(selection, (IUnknown**)&enum1);
+    EXPECT_HR(hr, S_OK);
+    ok(enum1 != NULL, "got %p\n", enum1);
+
+    ret = 0;
+    hr = IEnumVARIANT_Next(enum1, 2, &v[0], &ret);
+    EXPECT_HR(hr, S_OK);
+    ok(ret == 2, "got %d, expected 2\n", ret);
+    ok(V_VT(&v[0]) == VT_DISPATCH, "got var type %d\n", V_VT(&v[0]));
+
+    hr = IDispatch_QueryInterface(V_DISPATCH(&v[0]), &IID_IXMLDOMNode, (void**)&node);
+    EXPECT_HR(hr, S_OK);
+    hr = IXMLDOMNode_get_nodeName(node, &name);
+    EXPECT_HR(hr, S_OK);
+    ok(!lstrcmpW(name, L"a"), "got node name %s\n", wine_dbgstr_w(name));
+    SysFreeString(name);
+    IXMLDOMNode_Release(node);
+
+    hr = IDispatch_QueryInterface(V_DISPATCH(&v[1]), &IID_IXMLDOMNode, (void**)&node);
+    EXPECT_HR(hr, S_OK);
+    hr = IXMLDOMNode_get_nodeName(node, &name);
+    ok(!lstrcmpW(name, L"b"), "got node name %s\n", wine_dbgstr_w(name));
+    SysFreeString(name);
+    IXMLDOMNode_Release(node);
+
+    VariantClear(&v[1]);
+    VariantClear(&v[0]);
+
+    /* IEnumVARIANT_Next makes the IXMLDOMSelection cursor advance one step more */
+    hr = IXMLDOMSelection_nextNode(selection, &node);
+    EXPECT_HR(hr, S_OK);
+    hr = IXMLDOMNode_get_nodeName(node, &name);
+    EXPECT_HR(hr, S_OK);
+    ok(!lstrcmpW(name, L"d"), "got node name %s\n", wine_dbgstr_w(name));
+    SysFreeString(name);
+    IXMLDOMNode_Release(node);
+
+    /* The IEnumVARIANT cursor is still at position '2', */
+    /* therefore attempting to fetch 4 elements yields 'c' and 'd' */
+    ret = 0;
+    hr = IEnumVARIANT_Next(enum1, 4, &v[0], &ret);
+    EXPECT_HR(hr, S_FALSE);
+    ok(ret == 2, "got %d, expected 2\n", ret);
+
+    ok(V_VT(&v[0]) == VT_DISPATCH, "got var type %d\n", V_VT(&v[0]));
+    hr = IDispatch_QueryInterface(V_DISPATCH(&v[0]), &IID_IXMLDOMNode, (void**)&node);
+    EXPECT_HR(hr, S_OK);
+    hr = IXMLDOMNode_get_nodeName(node, &name);
+    EXPECT_HR(hr, S_OK);
+    ok(!lstrcmpW(name, L"c"), "got node name %s\n", wine_dbgstr_w(name));
+    SysFreeString(name);
+    IXMLDOMNode_Release(node);
+
+    ok(V_VT(&v[1]) == VT_DISPATCH, "got var type %d\n", V_VT(&v[1]));
+    hr = IDispatch_QueryInterface(V_DISPATCH(&v[1]), &IID_IXMLDOMNode, (void**)&node);
+    EXPECT_HR(hr, S_OK);
+    hr = IXMLDOMNode_get_nodeName(node, &name);
+    EXPECT_HR(hr, S_OK);
+    ok(!lstrcmpW(name, L"d"), "got node name %s\n", wine_dbgstr_w(name));
+    SysFreeString(name);
+    IXMLDOMNode_Release(node);
+
+    ok(V_VT(&v[2]) == VT_EMPTY, "got var type %d, expected %d (VT_EMPTY)\n", V_VT(&v[2]), VT_EMPTY);
+
+    VariantClear(&v[2]);
+    VariantClear(&v[1]);
+    VariantClear(&v[0]);
+
+    IEnumVARIANT_Release(enum1);
+
     IXMLDOMSelection_Release(selection);
     IXMLDOMNodeList_Release(list);
     IXMLDOMDocument_Release(doc);

[Marvin]

Hi,

While running your changed tests, I think I found new failures.
Being a bot and all I'm not very good at pattern recognition, so I might be
wrong, but could you please double-check?

Full results can be found at:
https://testbot.winehq.org/JobDetails.pl?Key=77444

Your paranoid android.

=== debiant (32 bit report) ===

msxml3:
Unhandled exception: page fault on read access to 0x121e0e16 in 32-bit code (0x6a3214ca).

[Nikolay Sivov]

On 8/21/20 11:17 PM, Gijs Vermeulen wrote:
> From: Alexandre Abgrall
>
> It must be the number of elements returned in 'var', as specified here:
> https://docs.microsoft.com/en-us/windows/win32/api/oaidl/nf-oaidl-ienumvaria...
>
> Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=40430
> Signed-off-by: Alexandre Abgrall 
> Signed-off-by: Gijs Vermeulen

Thanks, this looks good. I have one request, same function is used not
just for selection but for children list/nodemap/schema collection.
Could you check if we have tests covering all of those, and please add
what's missing.