Jacek Caban (@jacek) commented about dlls/mshtml/navigate.c:
if(This->bsc.binding) process_document_response_headers(This->bsc.window->doc, This->bsc.binding);
if(This->bsc.window->base.outer_window->readystate != READYSTATE_LOADING)
if(!(This->bsc.bindf & BINDF_ASYNCHRONOUS)) {
HTMLDocumentNode *doc = This->bsc.window->base.inner_window->doc;
HTMLDocumentObj *doc_obj = doc->doc_obj;
doc->doc_obj = NULL;
doc->cp_container.forward_container = NULL;
if(doc_obj->doc_node == doc) {
doc_obj->doc_node = NULL;
IHTMLDOMNode_Release(&doc->node.IHTMLDOMNode_iface);
}
This seems hackish, I think we could reset GeckoBrowser's document pointer early in document object's destructor instead of `detach_gecko_browser` and handle that where needed.