[PATCH v2 2/2] jscript: Use actual object disp for the return value when defining property.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Prevents crash when the object is not a jsdisp.

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/jscript/object.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/dlls/jscript/object.c b/dlls/jscript/object.c
index da544c6b1c3..843d029a53a 100644
--- a/dlls/jscript/object.c
+++ b/dlls/jscript/object.c
@@ -710,8 +710,10 @@ static HRESULT Object_defineProperty(script_ctx_t *ctx, jsval_t vthis, WORD flag
     hres = jsdisp_define_property(obj, name, &prop_desc);
     jsstr_release(name_str);
     release_property_descriptor(&prop_desc);
-    if(SUCCEEDED(hres) && r)
-        *r = jsval_obj(jsdisp_addref(obj));
+    if(SUCCEEDED(hres) && r) {
+        *r = jsval_disp(get_object(argv[0]));
+        IDispatch_AddRef(get_object(argv[0]));
+    }
     return hres;
 }