For the image load event patch, wine-gecko always sends them asynchronously, which is the same behavior as IE9+ modes. See `dom/base/nsImageLoadingContent.cpp: nsImageLoadingContent::FireEvent`. The comment there, funnily enough, is what script56.chm's script protects against (and breaks because of async behavior), but there's no way to selectively override it (because of compat mode), so we have to workaround it on mshtml side.
Note that we only hook the gecko events (nsevents) being dispatched, and that's obviously on purpose. We wouldn't want to skip a load event dispatched by some script or app's code.
-- v2: include/mshtmhst: Add CGID_ScriptSite and CMDIDs for it. mshtml/tests: Expect UpdateUI, Exec_UPDATECOMMANDS and Exec_SETTITLE in mshtml/tests: Allow BINDINFO_OPTIONS_ENABLE_UTF8 in bind options. mshtml: Don't lock document mode when querying IEventTarget. jscript: Pass correct 'this' to host objects in ES5 mode. mshtml: Send load event synchronously for img elements that loaded instantly mshtml: Keep a ref to the window during the doc nsevent handlers.