[PATCH 0/14] MR3631: mshtml: Implement Cycle Collection for all mshtml objects (dispex), part 6.

[Gabriel Ivăncescu (＠insn)]

This finishes all objects other than those that need the task_magic, or those that need to be separated from them.

First patch fixes a small mistake from previous MR, sorry for the noise.

[PATCH 01/14] mshtml: Use actual name when traversing variant.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/mshtml_private.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h
index 54c1e2cc338..5d117d70e29 100644
--- a/dlls/mshtml/mshtml_private.h
+++ b/dlls/mshtml/mshtml_private.h
@@ -1505,7 +1505,7 @@ static inline void unlink_variant(VARIANT *v)
 static inline void traverse_variant(VARIANT *v, const char *name, nsCycleCollectionTraversalCallback *cb)
 {
     if(V_VT(v) == VT_DISPATCH || V_VT(v) == VT_UNKNOWN)
-        note_cc_edge((nsISupports*)V_UNKNOWN(v), "dispex_data", cb);
+        note_cc_edge((nsISupports*)V_UNKNOWN(v), name, cb);
 }

#ifdef __i386__

[PATCH 02/14] mshtml: Implement Cycle Collection for HTMLDOMChildrenCollection.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlnode.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/dlls/mshtml/htmlnode.c b/dlls/mshtml/htmlnode.c
index 893a1a738f7..b7cd30c8c74 100644
--- a/dlls/mshtml/htmlnode.c
+++ b/dlls/mshtml/htmlnode.c
@@ -39,8 +39,6 @@ typedef struct {
     DispatchEx dispex;
     IHTMLDOMChildrenCollection IHTMLDOMChildrenCollection_iface;

-    LONG ref;
-
     nsIDOMNodeList *nslist;
 } HTMLDOMChildrenCollection;

@@ -208,7 +206,7 @@ static HRESULT WINAPI HTMLDOMChildrenCollection_QueryInterface(IHTMLDOMChildrenC
         *ppv = &This->IHTMLDOMChildrenCollection_iface;
     }else if(IsEqualGUID(&IID_IHTMLDOMChildrenCollection, riid)) {
         *ppv = &This->IHTMLDOMChildrenCollection_iface;
-    }else if(dispex_query_interface_no_cc(&This->dispex, riid, ppv)) {
+    }else if(dispex_query_interface(&This->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     }else {
         *ppv = NULL;
@@ -223,7 +221,7 @@ static HRESULT WINAPI HTMLDOMChildrenCollection_QueryInterface(IHTMLDOMChildrenC
 static ULONG WINAPI HTMLDOMChildrenCollection_AddRef(IHTMLDOMChildrenCollection *iface)
 {
     HTMLDOMChildrenCollection *This = impl_from_IHTMLDOMChildrenCollection(iface);
-    LONG ref = InterlockedIncrement(&This->ref);
+    LONG ref = dispex_ref_incr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

@@ -233,13 +231,10 @@ static ULONG WINAPI HTMLDOMChildrenCollection_AddRef(IHTMLDOMChildrenCollection
 static ULONG WINAPI HTMLDOMChildrenCollection_Release(IHTMLDOMChildrenCollection *iface)
 {
     HTMLDOMChildrenCollection *This = impl_from_IHTMLDOMChildrenCollection(iface);
-    LONG ref = InterlockedDecrement(&This->ref);
+    LONG ref = dispex_ref_decr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

-    if(!ref)
-        release_dispex(&This->dispex);
-
     return ref;
 }

@@ -360,6 +355,13 @@ static inline HTMLDOMChildrenCollection *impl_from_DispatchEx(DispatchEx *iface)
     return CONTAINING_RECORD(iface, HTMLDOMChildrenCollection, dispex);
 }

+static void HTMLDOMChildrenCollection_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLDOMChildrenCollection *This = impl_from_DispatchEx(dispex);
+    if(This->nslist)
+        note_cc_edge((nsISupports*)This->nslist, "nslist", cb);
+}
+
 static void HTMLDOMChildrenCollection_unlink(DispatchEx *dispex)
 {
     HTMLDOMChildrenCollection *This = impl_from_DispatchEx(dispex);
@@ -442,6 +444,7 @@ static HRESULT HTMLDOMChildrenCollection_invoke(DispatchEx *dispex, DISPID id, L

static const dispex_static_data_vtbl_t HTMLDOMChildrenCollection_dispex_vtbl = {
     .destructor       = HTMLDOMChildrenCollection_destructor,
+    .traverse         = HTMLDOMChildrenCollection_traverse,
     .unlink           = HTMLDOMChildrenCollection_unlink,
     .get_dispid       = HTMLDOMChildrenCollection_get_dispid,
     .get_name         = HTMLDOMChildrenCollection_get_name,
@@ -469,7 +472,6 @@ HRESULT create_child_collection(nsIDOMNodeList *nslist, compat_mode_t compat_mod
         return E_OUTOFMEMORY;

collection->IHTMLDOMChildrenCollection_iface.lpVtbl = &HTMLDOMChildrenCollectionVtbl;
-    collection->ref = 1;

nsIDOMNodeList_AddRef(nslist);
     collection->nslist = nslist;

[PATCH 03/14] mshtml: Implement Cycle Collection for HTMLElementCollection.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlelemcol.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/dlls/mshtml/htmlelemcol.c b/dlls/mshtml/htmlelemcol.c
index a9e489d2ca6..51c498cb9e9 100644
--- a/dlls/mshtml/htmlelemcol.c
+++ b/dlls/mshtml/htmlelemcol.c
@@ -37,8 +37,6 @@ typedef struct {

HTMLElement **elems;
     DWORD len;
-
-    LONG ref;
 } HTMLElementCollection;

typedef struct {
@@ -223,7 +221,7 @@ static HRESULT WINAPI HTMLElementCollection_QueryInterface(IHTMLElementCollectio
         *ppv = &This->IHTMLElementCollection_iface;
     }else if(IsEqualGUID(&IID_IHTMLElementCollection, riid)) {
         *ppv = &This->IHTMLElementCollection_iface;
-    }else if(dispex_query_interface_no_cc(&This->dispex, riid, ppv)) {
+    }else if(dispex_query_interface(&This->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     }else {
         *ppv = NULL;
@@ -238,7 +236,7 @@ static HRESULT WINAPI HTMLElementCollection_QueryInterface(IHTMLElementCollectio
 static ULONG WINAPI HTMLElementCollection_AddRef(IHTMLElementCollection *iface)
 {
     HTMLElementCollection *This = impl_from_IHTMLElementCollection(iface);
-    LONG ref = InterlockedIncrement(&This->ref);
+    LONG ref = dispex_ref_incr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

@@ -248,13 +246,10 @@ static ULONG WINAPI HTMLElementCollection_AddRef(IHTMLElementCollection *iface)
 static ULONG WINAPI HTMLElementCollection_Release(IHTMLElementCollection *iface)
 {
     HTMLElementCollection *This = impl_from_IHTMLElementCollection(iface);
-    LONG ref = InterlockedDecrement(&This->ref);
+    LONG ref = dispex_ref_decr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

-    if(!ref)
-        release_dispex(&This->dispex);
-
     return ref;
 }

@@ -542,6 +537,15 @@ static inline HTMLElementCollection *impl_from_DispatchEx(DispatchEx *iface)
     return CONTAINING_RECORD(iface, HTMLElementCollection, dispex);
 }

+static void HTMLElementCollection_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLElementCollection *This = impl_from_DispatchEx(dispex);
+    unsigned i;
+
+    for(i = 0; i < This->len; i++)
+        note_cc_edge((nsISupports*)&This->elems[i]->node.IHTMLDOMNode_iface, "elem", cb);
+}
+
 static void HTMLElementCollection_unlink(DispatchEx *dispex)
 {
     HTMLElementCollection *This = impl_from_DispatchEx(dispex);
@@ -634,6 +638,7 @@ static HRESULT HTMLElementCollection_invoke(DispatchEx *dispex, DISPID id, LCID

static const dispex_static_data_vtbl_t HTMLElementColection_dispex_vtbl = {
     .destructor       = HTMLElementCollection_destructor,
+    .traverse         = HTMLElementCollection_traverse,
     .unlink           = HTMLElementCollection_unlink,
     .get_dispid       = HTMLElementCollection_get_dispid,
     .get_name         = HTMLElementCollection_get_name,
@@ -864,7 +869,6 @@ static IHTMLElementCollection *HTMLElementCollection_Create(HTMLElement **elems,
         return NULL;

ret->IHTMLElementCollection_iface.lpVtbl = &HTMLElementCollectionVtbl;
-    ret->ref = 1;
     ret->elems = elems;
     ret->len = len;

[PATCH 04/14] mshtml: Implement Cycle Collection for HTMLRectCollection.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlelem.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/dlls/mshtml/htmlelem.c b/dlls/mshtml/htmlelem.c
index b557630a51a..eaed629c932 100644
--- a/dlls/mshtml/htmlelem.c
+++ b/dlls/mshtml/htmlelem.c
@@ -900,8 +900,6 @@ typedef struct {
     DispatchEx dispex;
     IHTMLRectCollection IHTMLRectCollection_iface;

-    LONG ref;
-
     nsIDOMClientRectList *rect_list;
 } HTMLRectCollection;

@@ -1053,7 +1051,7 @@ static HRESULT WINAPI HTMLRectCollection_QueryInterface(IHTMLRectCollection *ifa
         *ppv = &This->IHTMLRectCollection_iface;
     }else if(IsEqualGUID(&IID_IHTMLRectCollection, riid)) {
         *ppv = &This->IHTMLRectCollection_iface;
-    }else if(dispex_query_interface_no_cc(&This->dispex, riid, ppv)) {
+    }else if(dispex_query_interface(&This->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     }else {
         FIXME("(%p)->(%s %p)\n", This, debugstr_mshtml_guid(riid), ppv);
@@ -1068,7 +1066,7 @@ static HRESULT WINAPI HTMLRectCollection_QueryInterface(IHTMLRectCollection *ifa
 static ULONG WINAPI HTMLRectCollection_AddRef(IHTMLRectCollection *iface)
 {
     HTMLRectCollection *This = impl_from_IHTMLRectCollection(iface);
-    LONG ref = InterlockedIncrement(&This->ref);
+    LONG ref = dispex_ref_incr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

@@ -1078,13 +1076,10 @@ static ULONG WINAPI HTMLRectCollection_AddRef(IHTMLRectCollection *iface)
 static ULONG WINAPI HTMLRectCollection_Release(IHTMLRectCollection *iface)
 {
     HTMLRectCollection *This = impl_from_IHTMLRectCollection(iface);
-    LONG ref = InterlockedDecrement(&This->ref);
+    LONG ref = dispex_ref_decr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

-    if(!ref)
-        release_dispex(&This->dispex);
-
     return ref;
 }

@@ -1206,6 +1201,13 @@ static inline HTMLRectCollection *HTMLRectCollection_from_DispatchEx(DispatchEx
     return CONTAINING_RECORD(iface, HTMLRectCollection, dispex);
 }

+static void HTMLRectCollection_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLRectCollection *This = HTMLRectCollection_from_DispatchEx(dispex);
+    if(This->rect_list)
+        note_cc_edge((nsISupports*)This->rect_list, "rect_list", cb);
+}
+
 static void HTMLRectCollection_unlink(DispatchEx *dispex)
 {
     HTMLRectCollection *This = HTMLRectCollection_from_DispatchEx(dispex);
@@ -1294,6 +1296,7 @@ static HRESULT HTMLRectCollection_invoke(DispatchEx *dispex, DISPID id, LCID lci

static const dispex_static_data_vtbl_t HTMLRectCollection_dispex_vtbl = {
     .destructor       = HTMLRectCollection_destructor,
+    .traverse         = HTMLRectCollection_traverse,
     .unlink           = HTMLRectCollection_unlink,
     .get_dispid       = HTMLRectCollection_get_dispid,
     .get_name         = HTMLRectCollection_get_name,
@@ -3323,7 +3326,6 @@ static HRESULT WINAPI HTMLElement2_getClientRects(IHTMLElement2 *iface, IHTMLRec
     }

rects->IHTMLRectCollection_iface.lpVtbl = &HTMLRectCollectionVtbl;
-    rects->ref = 1;
     rects->rect_list = rect_list;
     init_dispatch(&rects->dispex, (IUnknown*)&rects->IHTMLRectCollection_iface,
                   &HTMLRectCollection_dispex, dispex_compat_mode(&This->node.event_target.dispex));

[PATCH 05/14] mshtml: Implement Cycle Collection for HTMLRect.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlelem.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/dlls/mshtml/htmlelem.c b/dlls/mshtml/htmlelem.c
index eaed629c932..e99c5813609 100644
--- a/dlls/mshtml/htmlelem.c
+++ b/dlls/mshtml/htmlelem.c
@@ -529,8 +529,6 @@ typedef struct {
     IHTMLRect IHTMLRect_iface;
     IHTMLRect2 IHTMLRect2_iface;

-    LONG ref;
-
     nsIDOMClientRect *nsrect;
 } HTMLRect;

@@ -551,7 +549,7 @@ static HRESULT WINAPI HTMLRect_QueryInterface(IHTMLRect *iface, REFIID riid, voi
         *ppv = &This->IHTMLRect_iface;
     }else if (IsEqualGUID(&IID_IHTMLRect2, riid)) {
         *ppv = &This->IHTMLRect2_iface;
-    }else if(dispex_query_interface_no_cc(&This->dispex, riid, ppv)) {
+    }else if(dispex_query_interface(&This->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     }else {
         FIXME("(%p)->(%s %p)\n", This, debugstr_mshtml_guid(riid), ppv);
@@ -566,7 +564,7 @@ static HRESULT WINAPI HTMLRect_QueryInterface(IHTMLRect *iface, REFIID riid, voi
 static ULONG WINAPI HTMLRect_AddRef(IHTMLRect *iface)
 {
     HTMLRect *This = impl_from_IHTMLRect(iface);
-    LONG ref = InterlockedIncrement(&This->ref);
+    LONG ref = dispex_ref_incr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

@@ -576,13 +574,10 @@ static ULONG WINAPI HTMLRect_AddRef(IHTMLRect *iface)
 static ULONG WINAPI HTMLRect_Release(IHTMLRect *iface)
 {
     HTMLRect *This = impl_from_IHTMLRect(iface);
-    LONG ref = InterlockedDecrement(&This->ref);
+    LONG ref = dispex_ref_decr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

-    if(!ref)
-        release_dispex(&This->dispex);
-
     return ref;
 }

@@ -840,6 +835,13 @@ static inline HTMLRect *HTMLRect_from_DispatchEx(DispatchEx *iface)
     return CONTAINING_RECORD(iface, HTMLRect, dispex);
 }

+static void HTMLRect_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLRect *This = HTMLRect_from_DispatchEx(dispex);
+    if(This->nsrect)
+        note_cc_edge((nsISupports*)This->nsrect, "nsrect", cb);
+}
+
 static void HTMLRect_unlink(DispatchEx *dispex)
 {
     HTMLRect *This = HTMLRect_from_DispatchEx(dispex);
@@ -860,6 +862,7 @@ void HTMLRect_init_dispex_info(dispex_data_t *info, compat_mode_t mode)

static const dispex_static_data_vtbl_t HTMLRect_dispex_vtbl = {
     .destructor       = HTMLRect_destructor,
+    .traverse         = HTMLRect_traverse,
     .unlink           = HTMLRect_unlink
 };

@@ -885,7 +888,6 @@ static HRESULT create_html_rect(nsIDOMClientRect *nsrect, compat_mode_t compat_m

rect->IHTMLRect_iface.lpVtbl = &HTMLRectVtbl;
     rect->IHTMLRect2_iface.lpVtbl = &HTMLRect2Vtbl;
-    rect->ref = 1;

init_dispatch(&rect->dispex, (IUnknown*)&rect->IHTMLRect_iface, &HTMLRect_dispex, compat_mode);

[PATCH 06/14] mshtml: Implement Cycle Collection for DOMTokenList.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlelem.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/dlls/mshtml/htmlelem.c b/dlls/mshtml/htmlelem.c
index e99c5813609..991f960f0ca 100644
--- a/dlls/mshtml/htmlelem.c
+++ b/dlls/mshtml/htmlelem.c
@@ -7374,8 +7374,6 @@ struct token_list {
     DispatchEx dispex;
     IWineDOMTokenList IWineDOMTokenList_iface;
     IHTMLElement *element;
-
-    LONG ref;
 };

static inline struct token_list *impl_from_IWineDOMTokenList(IWineDOMTokenList *iface)
@@ -7393,7 +7391,7 @@ static HRESULT WINAPI token_list_QueryInterface(IWineDOMTokenList *iface, REFIID
         *ppv = &token_list->IWineDOMTokenList_iface;
     }else if(IsEqualGUID(&IID_IWineDOMTokenList, riid)) {
         *ppv = &token_list->IWineDOMTokenList_iface;
-    }else if(dispex_query_interface_no_cc(&token_list->dispex, riid, ppv)) {
+    }else if(dispex_query_interface(&token_list->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     }else {
         WARN("(%p)->(%s %p)\n", token_list, debugstr_mshtml_guid(riid), ppv);
@@ -7408,7 +7406,7 @@ static HRESULT WINAPI token_list_QueryInterface(IWineDOMTokenList *iface, REFIID
 static ULONG WINAPI token_list_AddRef(IWineDOMTokenList *iface)
 {
     struct token_list *token_list = impl_from_IWineDOMTokenList(iface);
-    LONG ref = InterlockedIncrement(&token_list->ref);
+    LONG ref = dispex_ref_incr(&token_list->dispex);

TRACE("(%p) ref=%ld\n", token_list, ref);

@@ -7418,13 +7416,10 @@ static ULONG WINAPI token_list_AddRef(IWineDOMTokenList *iface)
 static ULONG WINAPI token_list_Release(IWineDOMTokenList *iface)
 {
     struct token_list *token_list = impl_from_IWineDOMTokenList(iface);
-    LONG ref = InterlockedDecrement(&token_list->ref);
+    LONG ref = dispex_ref_decr(&token_list->dispex);

TRACE("(%p) ref=%ld\n", token_list, ref);

-    if(!ref)
-        release_dispex(&token_list->dispex);
-
     return ref;
 }

@@ -7742,6 +7737,13 @@ static inline struct token_list *token_list_from_DispatchEx(DispatchEx *iface)
     return CONTAINING_RECORD(iface, struct token_list, dispex);
 }

+static void token_list_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    struct token_list *token_list = token_list_from_DispatchEx(dispex);
+    if(token_list->element)
+        note_cc_edge((nsISupports*)token_list->element, "element", cb);
+}
+
 static void token_list_unlink(DispatchEx *dispex)
 {
     struct token_list *token_list = token_list_from_DispatchEx(dispex);
@@ -7830,6 +7832,7 @@ static HRESULT token_list_invoke(DispatchEx *dispex, DISPID id, LCID lcid, WORD

static const dispex_static_data_vtbl_t token_list_dispex_vtbl = {
     .destructor       = token_list_destructor,
+    .traverse         = token_list_traverse,
     .unlink           = token_list_unlink,
     .value            = token_list_value,
     .get_dispid       = token_list_get_dispid,
@@ -7860,7 +7863,6 @@ static HRESULT create_token_list(compat_mode_t compat_mode, IHTMLElement *elemen
     }

obj->IWineDOMTokenList_iface.lpVtbl = &WineDOMTokenListVtbl;
-    obj->ref = 1;
     init_dispatch(&obj->dispex, (IUnknown*)&obj->IWineDOMTokenList_iface, &token_list_dispex, compat_mode);
     IHTMLElement_AddRef(element);
     obj->element = element;

[PATCH 07/14] mshtml: Implement Cycle Collection for MutationObserver.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/mutation.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/dlls/mshtml/mutation.c b/dlls/mshtml/mutation.c
index 13c95eeac05..1abb2d88839 100644
--- a/dlls/mshtml/mutation.c
+++ b/dlls/mshtml/mutation.c
@@ -1080,7 +1080,6 @@ void init_mutation(nsIComponentManager *component_manager)
 struct mutation_observer {
     IWineMSHTMLMutationObserver IWineMSHTMLMutationObserver_iface;

-    LONG ref;
     DispatchEx dispex;
     IDispatch *callback;
 };
@@ -1098,7 +1097,7 @@ static HRESULT WINAPI MutationObserver_QueryInterface(IWineMSHTMLMutationObserve

if(IsEqualGUID(&IID_IUnknown, riid) || IsEqualGUID(&IID_IWineMSHTMLMutationObserver, riid)) {
         *ppv = &This->IWineMSHTMLMutationObserver_iface;
-    } else if(dispex_query_interface_no_cc(&This->dispex, riid, ppv)) {
+    } else if(dispex_query_interface(&This->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     } else {
         WARN("(%p)->(%s %p)\n", This, debugstr_mshtml_guid(riid), ppv);
@@ -1113,7 +1112,7 @@ static HRESULT WINAPI MutationObserver_QueryInterface(IWineMSHTMLMutationObserve
 static ULONG WINAPI MutationObserver_AddRef(IWineMSHTMLMutationObserver *iface)
 {
     struct mutation_observer *This = impl_from_IWineMSHTMLMutationObserver(iface);
-    LONG ref = InterlockedIncrement(&This->ref);
+    LONG ref = dispex_ref_incr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

@@ -1123,13 +1122,10 @@ static ULONG WINAPI MutationObserver_AddRef(IWineMSHTMLMutationObserver *iface)
 static ULONG WINAPI MutationObserver_Release(IWineMSHTMLMutationObserver *iface)
 {
     struct mutation_observer *This = impl_from_IWineMSHTMLMutationObserver(iface);
-    LONG ref = InterlockedDecrement(&This->ref);
+    LONG ref = dispex_ref_decr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

-    if(!ref)
-        release_dispex(&This->dispex);
-
     return ref;
 }

@@ -1215,6 +1211,13 @@ static inline struct mutation_observer *mutation_observer_from_DispatchEx(Dispat
     return CONTAINING_RECORD(iface, struct mutation_observer, dispex);
 }

+static void mutation_observer_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    struct mutation_observer *This = mutation_observer_from_DispatchEx(dispex);
+    if(This->callback)
+        note_cc_edge((nsISupports*)This->callback, "callback", cb);
+}
+
 static void mutation_observer_unlink(DispatchEx *dispex)
 {
     struct mutation_observer *This = mutation_observer_from_DispatchEx(dispex);
@@ -1229,6 +1232,7 @@ static void mutation_observer_destructor(DispatchEx *dispex)

static const dispex_static_data_vtbl_t mutation_observer_dispex_vtbl = {
     .destructor       = mutation_observer_destructor,
+    .traverse         = mutation_observer_traverse,
     .unlink           = mutation_observer_unlink
 };

@@ -1258,7 +1262,6 @@ static HRESULT create_mutation_observer(compat_mode_t compat_mode, IDispatch *ca
     }

obj->IWineMSHTMLMutationObserver_iface.lpVtbl = &WineMSHTMLMutationObserverVtbl;
-    obj->ref = 1;
     init_dispatch(&obj->dispex, (IUnknown*)&obj->IWineMSHTMLMutationObserver_iface,
                   &mutation_observer_dispex, compat_mode);

[PATCH 08/14] mshtml: Implement Cycle Collection for HTMLDOMImplementation.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/omnavigator.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/dlls/mshtml/omnavigator.c b/dlls/mshtml/omnavigator.c
index 75803b5c28b..56bf6284e2f 100644
--- a/dlls/mshtml/omnavigator.c
+++ b/dlls/mshtml/omnavigator.c
@@ -47,8 +47,6 @@ typedef struct {
     IHTMLDOMImplementation IHTMLDOMImplementation_iface;
     IHTMLDOMImplementation2 IHTMLDOMImplementation2_iface;

-    LONG ref;
-
     nsIDOMDOMImplementation *implementation;
     GeckoBrowser *browser;
 } HTMLDOMImplementation;
@@ -68,7 +66,7 @@ static HRESULT WINAPI HTMLDOMImplementation_QueryInterface(IHTMLDOMImplementatio
         *ppv = &This->IHTMLDOMImplementation_iface;
     }else if(IsEqualGUID(&IID_IHTMLDOMImplementation2, riid)) {
         *ppv = &This->IHTMLDOMImplementation2_iface;
-    }else if(dispex_query_interface_no_cc(&This->dispex, riid, ppv)) {
+    }else if(dispex_query_interface(&This->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     }else {
         WARN("Unsupported interface %s\n", debugstr_mshtml_guid(riid));
@@ -83,7 +81,7 @@ static HRESULT WINAPI HTMLDOMImplementation_QueryInterface(IHTMLDOMImplementatio
 static ULONG WINAPI HTMLDOMImplementation_AddRef(IHTMLDOMImplementation *iface)
 {
     HTMLDOMImplementation *This = impl_from_IHTMLDOMImplementation(iface);
-    LONG ref = InterlockedIncrement(&This->ref);
+    LONG ref = dispex_ref_incr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

@@ -93,13 +91,10 @@ static ULONG WINAPI HTMLDOMImplementation_AddRef(IHTMLDOMImplementation *iface)
 static ULONG WINAPI HTMLDOMImplementation_Release(IHTMLDOMImplementation *iface)
 {
     HTMLDOMImplementation *This = impl_from_IHTMLDOMImplementation(iface);
-    LONG ref = InterlockedDecrement(&This->ref);
+    LONG ref = dispex_ref_decr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

-    if(!ref)
-        release_dispex(&This->dispex);
-
     return ref;
 }

@@ -292,6 +287,13 @@ static inline HTMLDOMImplementation *HTMLDOMImplementation_from_DispatchEx(Dispa
     return CONTAINING_RECORD(iface, HTMLDOMImplementation, dispex);
 }

+static void HTMLDOMImplementation_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLDOMImplementation *This = HTMLDOMImplementation_from_DispatchEx(dispex);
+    if(This->implementation)
+        note_cc_edge((nsISupports*)This->implementation, "implementation", cb);
+}
+
 static void HTMLDOMImplementation_unlink(DispatchEx *dispex)
 {
     HTMLDOMImplementation *This = HTMLDOMImplementation_from_DispatchEx(dispex);
@@ -307,6 +309,7 @@ static void HTMLDOMImplementation_destructor(DispatchEx *dispex)

static const dispex_static_data_vtbl_t HTMLDOMImplementation_dispex_vtbl = {
     .destructor       = HTMLDOMImplementation_destructor,
+    .traverse         = HTMLDOMImplementation_traverse,
     .unlink           = HTMLDOMImplementation_unlink
 };

@@ -342,7 +345,6 @@ HRESULT create_dom_implementation(HTMLDocumentNode *doc_node, IHTMLDOMImplementa

dom_implementation->IHTMLDOMImplementation_iface.lpVtbl = &HTMLDOMImplementationVtbl;
     dom_implementation->IHTMLDOMImplementation2_iface.lpVtbl = &HTMLDOMImplementation2Vtbl;
-    dom_implementation->ref = 1;
     dom_implementation->browser = doc_node->browser;

init_dispatch(&dom_implementation->dispex, (IUnknown*)&dom_implementation->IHTMLDOMImplementation_iface,

[PATCH 09/14] mshtml: Implement Cycle Collection for MediaQueryList.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/omnavigator.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/dlls/mshtml/omnavigator.c b/dlls/mshtml/omnavigator.c
index 56bf6284e2f..dad73af826a 100644
--- a/dlls/mshtml/omnavigator.c
+++ b/dlls/mshtml/omnavigator.c
@@ -2826,7 +2826,6 @@ struct media_query_list_callback;
 struct media_query_list {
     DispatchEx dispex;
     IWineMSHTMLMediaQueryList IWineMSHTMLMediaQueryList_iface;
-    LONG ref;
     nsIDOMMediaQueryList *nsquerylist;
     struct media_query_list_callback *callback;
     struct list listeners;
@@ -2851,7 +2850,7 @@ static HRESULT WINAPI media_query_list_QueryInterface(IWineMSHTMLMediaQueryList

if(IsEqualGUID(&IID_IUnknown, riid) || IsEqualGUID(&IID_IWineMSHTMLMediaQueryList, riid)) {
         *ppv = &media_query_list->IWineMSHTMLMediaQueryList_iface;
-    }else if(dispex_query_interface_no_cc(&media_query_list->dispex, riid, ppv)) {
+    }else if(dispex_query_interface(&media_query_list->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     }else {
         *ppv = NULL;
@@ -2865,7 +2864,7 @@ static HRESULT WINAPI media_query_list_QueryInterface(IWineMSHTMLMediaQueryList
 static ULONG WINAPI media_query_list_AddRef(IWineMSHTMLMediaQueryList *iface)
 {
     struct media_query_list *media_query_list = impl_from_IWineMSHTMLMediaQueryList(iface);
-    LONG ref = InterlockedIncrement(&media_query_list->ref);
+    LONG ref = dispex_ref_incr(&media_query_list->dispex);

TRACE("(%p) ref=%ld\n", media_query_list, ref);

@@ -2875,13 +2874,10 @@ static ULONG WINAPI media_query_list_AddRef(IWineMSHTMLMediaQueryList *iface)
 static ULONG WINAPI media_query_list_Release(IWineMSHTMLMediaQueryList *iface)
 {
     struct media_query_list *media_query_list = impl_from_IWineMSHTMLMediaQueryList(iface);
-    LONG ref = InterlockedDecrement(&media_query_list->ref);
+    LONG ref = dispex_ref_decr(&media_query_list->dispex);

TRACE("(%p) ref=%ld\n", media_query_list, ref);

-    if(!ref)
-        release_dispex(&media_query_list->dispex);
-
     return ref;
 }

@@ -3106,6 +3102,17 @@ static inline struct media_query_list *media_query_list_from_DispatchEx(Dispatch
     return CONTAINING_RECORD(iface, struct media_query_list, dispex);
 }

+static void media_query_list_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    struct media_query_list *media_query_list = media_query_list_from_DispatchEx(dispex);
+    struct media_query_list_listener *listener;
+
+    LIST_FOR_EACH_ENTRY(listener, &media_query_list->listeners, struct media_query_list_listener, entry)
+        note_cc_edge((nsISupports*)listener->function, "function", cb);
+    if(media_query_list->nsquerylist)
+        note_cc_edge((nsISupports*)media_query_list->nsquerylist, "nsquerylist", cb);
+}
+
 static void media_query_list_unlink(DispatchEx *dispex)
 {
     struct media_query_list *media_query_list = media_query_list_from_DispatchEx(dispex);
@@ -3129,6 +3136,7 @@ static void media_query_list_destructor(DispatchEx *dispex)

static const dispex_static_data_vtbl_t media_query_list_dispex_vtbl = {
     .destructor       = media_query_list_destructor,
+    .traverse         = media_query_list_traverse,
     .unlink           = media_query_list_unlink
 };

@@ -3180,7 +3188,6 @@ HRESULT create_media_query_list(HTMLWindow *window, BSTR media_query, IDispatch
     assert(NS_SUCCEEDED(nsres));

media_query_list->IWineMSHTMLMediaQueryList_iface.lpVtbl = &media_query_list_vtbl;
-    media_query_list->ref = 1;
     list_init(&media_query_list->listeners);
     init_dispatch(&media_query_list->dispex, (IUnknown*)&media_query_list->IWineMSHTMLMediaQueryList_iface,
                   &media_query_list_dispex, dispex_compat_mode(&window->inner_window->event_target.dispex));

[PATCH 10/14] mshtml: Implement Cycle Collection for HTMLTextRange.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/range.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/dlls/mshtml/range.c b/dlls/mshtml/range.c
index 3ac3fcb73a4..203267e9a1f 100644
--- a/dlls/mshtml/range.c
+++ b/dlls/mshtml/range.c
@@ -37,8 +37,6 @@ typedef struct {
     IHTMLTxtRange     IHTMLTxtRange_iface;
     IOleCommandTarget IOleCommandTarget_iface;

-    LONG ref;
-
     nsIDOMRange *nsrange;
     HTMLDocumentNode *doc;

@@ -49,8 +47,6 @@ typedef struct {
     DispatchEx dispex;
     IHTMLDOMRange IHTMLDOMRange_iface;

-    LONG ref;
-
     nsIDOMRange *nsrange;
 } HTMLDOMRange;

@@ -826,7 +822,7 @@ static HRESULT WINAPI HTMLTxtRange_QueryInterface(IHTMLTxtRange *iface, REFIID r
         *ppv = &This->IHTMLTxtRange_iface;
     }else if(IsEqualGUID(&IID_IOleCommandTarget, riid)) {
         *ppv = &This->IOleCommandTarget_iface;
-    }else if(dispex_query_interface_no_cc(&This->dispex, riid, ppv)) {
+    }else if(dispex_query_interface(&This->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     }else {
         *ppv = NULL;
@@ -841,7 +837,7 @@ static HRESULT WINAPI HTMLTxtRange_QueryInterface(IHTMLTxtRange *iface, REFIID r
 static ULONG WINAPI HTMLTxtRange_AddRef(IHTMLTxtRange *iface)
 {
     HTMLTxtRange *This = impl_from_IHTMLTxtRange(iface);
-    LONG ref = InterlockedIncrement(&This->ref);
+    LONG ref = dispex_ref_incr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

@@ -851,13 +847,10 @@ static ULONG WINAPI HTMLTxtRange_AddRef(IHTMLTxtRange *iface)
 static ULONG WINAPI HTMLTxtRange_Release(IHTMLTxtRange *iface)
 {
     HTMLTxtRange *This = impl_from_IHTMLTxtRange(iface);
-    LONG ref = InterlockedDecrement(&This->ref);
+    LONG ref = dispex_ref_decr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

-    if(!ref)
-        release_dispex(&This->dispex);
-
     return ref;
 }

@@ -1717,6 +1710,13 @@ static inline HTMLTxtRange *HTMLTxtRange_from_DispatchEx(DispatchEx *iface)
     return CONTAINING_RECORD(iface, HTMLTxtRange, dispex);
 }

+static void HTMLTxtRange_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLTxtRange *This = HTMLTxtRange_from_DispatchEx(dispex);
+    if(This->nsrange)
+        note_cc_edge((nsISupports*)This->nsrange, "nsrange", cb);
+}
+
 static void HTMLTxtRange_unlink(DispatchEx *dispex)
 {
     HTMLTxtRange *This = HTMLTxtRange_from_DispatchEx(dispex);
@@ -1735,6 +1735,7 @@ static void HTMLTxtRange_destructor(DispatchEx *dispex)

static const dispex_static_data_vtbl_t HTMLTxtRange_dispex_vtbl = {
     .destructor       = HTMLTxtRange_destructor,
+    .traverse         = HTMLTxtRange_traverse,
     .unlink           = HTMLTxtRange_unlink
 };

@@ -1762,7 +1763,6 @@ HRESULT HTMLTxtRange_Create(HTMLDocumentNode *doc, nsIDOMRange *nsrange, IHTMLTx

ret->IHTMLTxtRange_iface.lpVtbl = &HTMLTxtRangeVtbl;
     ret->IOleCommandTarget_iface.lpVtbl = &OleCommandTargetVtbl;
-    ret->ref = 1;

if(nsrange)
         nsIDOMRange_AddRef(nsrange);

[PATCH 11/14] mshtml: Implement Cycle Collection for HTMLDOMRange.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/range.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/dlls/mshtml/range.c b/dlls/mshtml/range.c
index 203267e9a1f..71e225a587e 100644
--- a/dlls/mshtml/range.c
+++ b/dlls/mshtml/range.c
@@ -1790,7 +1790,7 @@ static HRESULT WINAPI HTMLDOMRange_QueryInterface(IHTMLDOMRange *iface, REFIID r
         *ppv = &This->IHTMLDOMRange_iface;
     }else if(IsEqualGUID(&IID_IHTMLDOMRange, riid)) {
         *ppv = &This->IHTMLDOMRange_iface;
-    }else if(dispex_query_interface_no_cc(&This->dispex, riid, ppv)) {
+    }else if(dispex_query_interface(&This->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     }else {
         *ppv = NULL;
@@ -1805,7 +1805,7 @@ static HRESULT WINAPI HTMLDOMRange_QueryInterface(IHTMLDOMRange *iface, REFIID r
 static ULONG WINAPI HTMLDOMRange_AddRef(IHTMLDOMRange *iface)
 {
     HTMLDOMRange *This = impl_from_IHTMLDOMRange(iface);
-    LONG ref = InterlockedIncrement(&This->ref);
+    LONG ref = dispex_ref_incr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

@@ -1815,13 +1815,10 @@ static ULONG WINAPI HTMLDOMRange_AddRef(IHTMLDOMRange *iface)
 static ULONG WINAPI HTMLDOMRange_Release(IHTMLDOMRange *iface)
 {
     HTMLDOMRange *This = impl_from_IHTMLDOMRange(iface);
-    LONG ref = InterlockedDecrement(&This->ref);
+    LONG ref = dispex_ref_decr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

-    if(!ref)
-        release_dispex(&This->dispex);
-
     return ref;
 }

@@ -2084,6 +2081,13 @@ static inline HTMLDOMRange *HTMLDOMRange_from_DispatchEx(DispatchEx *iface)
     return CONTAINING_RECORD(iface, HTMLDOMRange, dispex);
 }

+static void HTMLDOMRange_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLDOMRange *This = HTMLDOMRange_from_DispatchEx(dispex);
+    if(This->nsrange)
+        note_cc_edge((nsISupports*)This->nsrange, "nsrange", cb);
+}
+
 static void HTMLDOMRange_unlink(DispatchEx *dispex)
 {
     HTMLDOMRange *This = HTMLDOMRange_from_DispatchEx(dispex);
@@ -2098,6 +2102,7 @@ static void HTMLDOMRange_destructor(DispatchEx *dispex)

static const dispex_static_data_vtbl_t HTMLDOMRange_dispex_vtbl = {
     .destructor       = HTMLDOMRange_destructor,
+    .traverse         = HTMLDOMRange_traverse,
     .unlink           = HTMLDOMRange_unlink
 };

@@ -2124,7 +2129,6 @@ HRESULT create_dom_range(nsIDOMRange *nsrange, compat_mode_t compat_mode, IHTMLD
     init_dispatch(&ret->dispex, (IUnknown*)&ret->IHTMLDOMRange_iface, &HTMLDOMRange_dispex, compat_mode);

ret->IHTMLDOMRange_iface.lpVtbl = &HTMLDOMRangeVtbl;
-    ret->ref = 1;

if(nsrange)
         nsIDOMRange_AddRef(nsrange);

[PATCH 12/14] mshtml: Implement Cycle Collection for HTMLSelectionObject.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/selection.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/dlls/mshtml/selection.c b/dlls/mshtml/selection.c
index ae53d83f642..97f65a2b22c 100644
--- a/dlls/mshtml/selection.c
+++ b/dlls/mshtml/selection.c
@@ -36,8 +36,6 @@ typedef struct {
     IHTMLSelectionObject IHTMLSelectionObject_iface;
     IHTMLSelectionObject2 IHTMLSelectionObject2_iface;

-    LONG ref;
-
     nsISelection *nsselection;
     HTMLDocumentNode *doc;

@@ -64,7 +62,7 @@ static HRESULT WINAPI HTMLSelectionObject_QueryInterface(IHTMLSelectionObject *i
         *ppv = &This->IHTMLSelectionObject_iface;
     }else if(IsEqualGUID(&IID_IHTMLSelectionObject2, riid)) {
         *ppv = &This->IHTMLSelectionObject2_iface;
-    }else if(dispex_query_interface_no_cc(&This->dispex, riid, ppv)) {
+    }else if(dispex_query_interface(&This->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     }else {
         *ppv = NULL;
@@ -79,7 +77,7 @@ static HRESULT WINAPI HTMLSelectionObject_QueryInterface(IHTMLSelectionObject *i
 static ULONG WINAPI HTMLSelectionObject_AddRef(IHTMLSelectionObject *iface)
 {
     HTMLSelectionObject *This = impl_from_IHTMLSelectionObject(iface);
-    LONG ref = InterlockedIncrement(&This->ref);
+    LONG ref = dispex_ref_incr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

@@ -89,13 +87,10 @@ static ULONG WINAPI HTMLSelectionObject_AddRef(IHTMLSelectionObject *iface)
 static ULONG WINAPI HTMLSelectionObject_Release(IHTMLSelectionObject *iface)
 {
     HTMLSelectionObject *This = impl_from_IHTMLSelectionObject(iface);
-    LONG ref = InterlockedDecrement(&This->ref);
+    LONG ref = dispex_ref_decr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

-    if(!ref)
-        release_dispex(&This->dispex);
-
     return ref;
 }

@@ -328,6 +323,13 @@ static inline HTMLSelectionObject *impl_from_DispatchEx(DispatchEx *iface)
     return CONTAINING_RECORD(iface, HTMLSelectionObject, dispex);
 }

+static void HTMLSelectionObject_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLSelectionObject *This = impl_from_DispatchEx(dispex);
+    if(This->nsselection)
+        note_cc_edge((nsISupports*)This->nsselection, "nsselection", cb);
+}
+
 static void HTMLSelectionObject_unlink(DispatchEx *dispex)
 {
     HTMLSelectionObject *This = impl_from_DispatchEx(dispex);
@@ -346,6 +348,7 @@ static void HTMLSelectionObject_destructor(DispatchEx *dispex)

static const dispex_static_data_vtbl_t HTMLSelectionObject_dispex_vtbl = {
     .destructor       = HTMLSelectionObject_destructor,
+    .traverse         = HTMLSelectionObject_traverse,
     .unlink           = HTMLSelectionObject_unlink
 };

@@ -374,7 +377,6 @@ HRESULT HTMLSelectionObject_Create(HTMLDocumentNode *doc, nsISelection *nsselect

selection->IHTMLSelectionObject_iface.lpVtbl = &HTMLSelectionObjectVtbl;
     selection->IHTMLSelectionObject2_iface.lpVtbl = &HTMLSelectionObject2Vtbl;
-    selection->ref = 1;
     selection->nsselection = nsselection; /* We shouldn't call AddRef here */

selection->doc = doc;

[PATCH 13/14] mshtml: Implement Cycle Collection for HTMLEventObj.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlevent.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/dlls/mshtml/htmlevent.c b/dlls/mshtml/htmlevent.c
index 9f3dbae81d7..22fe681abda 100644
--- a/dlls/mshtml/htmlevent.c
+++ b/dlls/mshtml/htmlevent.c
@@ -335,8 +335,6 @@ typedef struct {
     DispatchEx dispex;
     IHTMLEventObj IHTMLEventObj_iface;

-    LONG ref;
-
     DOMEvent *event;
     VARIANT return_value;
 } HTMLEventObj;
@@ -356,7 +354,7 @@ static HRESULT WINAPI HTMLEventObj_QueryInterface(IHTMLEventObj *iface, REFIID r
         *ppv = &This->IHTMLEventObj_iface;
     }else if(IsEqualGUID(&IID_IHTMLEventObj, riid)) {
         *ppv = &This->IHTMLEventObj_iface;
-    }else if(dispex_query_interface_no_cc(&This->dispex, riid, ppv)) {
+    }else if(dispex_query_interface(&This->dispex, riid, ppv)) {
         return *ppv ? S_OK : E_NOINTERFACE;
     }else {
         *ppv = NULL;
@@ -371,7 +369,7 @@ static HRESULT WINAPI HTMLEventObj_QueryInterface(IHTMLEventObj *iface, REFIID r
 static ULONG WINAPI HTMLEventObj_AddRef(IHTMLEventObj *iface)
 {
     HTMLEventObj *This = impl_from_IHTMLEventObj(iface);
-    LONG ref = InterlockedIncrement(&This->ref);
+    LONG ref = dispex_ref_incr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

@@ -381,13 +379,10 @@ static ULONG WINAPI HTMLEventObj_AddRef(IHTMLEventObj *iface)
 static ULONG WINAPI HTMLEventObj_Release(IHTMLEventObj *iface)
 {
     HTMLEventObj *This = impl_from_IHTMLEventObj(iface);
-    LONG ref = InterlockedDecrement(&This->ref);
+    LONG ref = dispex_ref_decr(&This->dispex);

TRACE("(%p) ref=%ld\n", This, ref);

-    if(!ref)
-        release_dispex(&This->dispex);
-
     return ref;
 }

@@ -873,6 +868,13 @@ static inline HTMLEventObj *HTMLEventObj_from_DispatchEx(DispatchEx *iface)
     return CONTAINING_RECORD(iface, HTMLEventObj, dispex);
 }

+static void HTMLEventObj_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLEventObj *This = HTMLEventObj_from_DispatchEx(dispex);
+    if(This->event)
+        note_cc_edge((nsISupports*)&This->event->IDOMEvent_iface, "event", cb);
+}
+
 static void HTMLEventObj_unlink(DispatchEx *dispex)
 {
     HTMLEventObj *This = HTMLEventObj_from_DispatchEx(dispex);
@@ -891,6 +893,7 @@ static void HTMLEventObj_destructor(DispatchEx *dispex)

static const dispex_static_data_vtbl_t HTMLEventObj_dispex_vtbl = {
     .destructor       = HTMLEventObj_destructor,
+    .traverse         = HTMLEventObj_traverse,
     .unlink           = HTMLEventObj_unlink
 };

@@ -915,7 +918,6 @@ static HTMLEventObj *alloc_event_obj(DOMEvent *event, compat_mode_t compat_mode)
         return NULL;

event_obj->IHTMLEventObj_iface.lpVtbl = &HTMLEventObjVtbl;
-    event_obj->ref = 1;
     event_obj->event = event;
     if(event)
         IDOMEvent_AddRef(&event->IDOMEvent_iface);

[PATCH 14/14] mshtml: Implement Cycle Collection for DOM Events.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlevent.c | 73 +++++++++++++++++++++++++++++++++++++----
 dlls/mshtml/htmlevent.h |  1 -
 2 files changed, 66 insertions(+), 8 deletions(-)

diff --git a/dlls/mshtml/htmlevent.c b/dlls/mshtml/htmlevent.c
index 22fe681abda..13fa4e5b505 100644
--- a/dlls/mshtml/htmlevent.c
+++ b/dlls/mshtml/htmlevent.c
@@ -960,7 +960,7 @@ static HRESULT WINAPI DOMEvent_QueryInterface(IDOMEvent *iface, REFIID riid, voi
         *ppv = &This->IDOMEvent_iface;
     else if(IsEqualGUID(&IID_IDOMEvent, riid))
         *ppv = &This->IDOMEvent_iface;
-    else if(dispex_query_interface_no_cc(&This->dispex, riid, ppv))
+    else if(dispex_query_interface(&This->dispex, riid, ppv))
         return *ppv ? S_OK : E_NOINTERFACE;
     else if(!This->query_interface || !(*ppv = This->query_interface(This, riid))) {
         *ppv = NULL;
@@ -975,7 +975,7 @@ static HRESULT WINAPI DOMEvent_QueryInterface(IDOMEvent *iface, REFIID riid, voi
 static ULONG WINAPI DOMEvent_AddRef(IDOMEvent *iface)
 {
     DOMEvent *This = impl_from_IDOMEvent(iface);
-    LONG ref = InterlockedIncrement(&This->ref);
+    LONG ref = dispex_ref_incr(&This->dispex);

TRACE("(%p) ref=%lu\n", This, ref);

@@ -985,13 +985,10 @@ static ULONG WINAPI DOMEvent_AddRef(IDOMEvent *iface)
 static ULONG WINAPI DOMEvent_Release(IDOMEvent *iface)
 {
     DOMEvent *This = impl_from_IDOMEvent(iface);
-    LONG ref = InterlockedDecrement(&This->ref);
+    LONG ref = dispex_ref_decr(&This->dispex);

TRACE("(%p) ref=%lu\n", This, ref);

-    if(!ref)
-        release_dispex(&This->dispex);
-
     return ref;
 }

@@ -1255,6 +1252,15 @@ static inline DOMEvent *DOMEvent_from_DispatchEx(DispatchEx *iface)
     return CONTAINING_RECORD(iface, DOMEvent, dispex);
 }

+static void DOMEvent_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    DOMEvent *This = DOMEvent_from_DispatchEx(dispex);
+    if(This->target)
+        note_cc_edge((nsISupports*)&This->target->IEventTarget_iface, "target", cb);
+    if(This->nsevent)
+        note_cc_edge((nsISupports*)This->nsevent, "nsevent", cb);
+}
+
 static void DOMEvent_unlink(DispatchEx *dispex)
 {
     DOMEvent *This = DOMEvent_from_DispatchEx(dispex);
@@ -1421,6 +1427,14 @@ static void *DOMUIEvent_query_interface(DOMEvent *event, REFIID riid)
     return NULL;
 }

+static void DOMUIEvent_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    DOMUIEvent *This = DOMUIEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
+    DOMEvent_traverse(&This->event.dispex, cb);
+    if(This->nsevent)
+        note_cc_edge((nsISupports*)This->nsevent, "UIEvent.nsevent", cb);
+}
+
 static void DOMUIEvent_unlink(DispatchEx *dispex)
 {
     DOMUIEvent *This = DOMUIEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
@@ -1953,6 +1967,14 @@ static void *DOMMouseEvent_query_interface(DOMEvent *event, REFIID riid)
     return NULL;
 }

+static void DOMMouseEvent_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    DOMMouseEvent *This = DOMMouseEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
+    DOMUIEvent_traverse(&This->ui_event.event.dispex, cb);
+    if(This->nsevent)
+        note_cc_edge((nsISupports*)This->nsevent, "MouseEvent.nsevent", cb);
+}
+
 static void DOMMouseEvent_unlink(DispatchEx *dispex)
 {
     DOMMouseEvent *This = DOMMouseEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
@@ -2252,6 +2274,14 @@ static void *DOMKeyboardEvent_query_interface(DOMEvent *event, REFIID riid)
     return NULL;
 }

+static void DOMKeyboardEvent_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    DOMKeyboardEvent *This = DOMKeyboardEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
+    DOMUIEvent_traverse(&This->ui_event.event.dispex, cb);
+    if(This->nsevent)
+        note_cc_edge((nsISupports*)This->nsevent, "KeyboardEvent.nsevent", cb);
+}
+
 static void DOMKeyboardEvent_unlink(DispatchEx *dispex)
 {
     DOMKeyboardEvent *This = DOMKeyboardEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
@@ -2460,6 +2490,13 @@ static void *DOMCustomEvent_query_interface(DOMEvent *event, REFIID riid)
     return NULL;
 }

+static void DOMCustomEvent_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    DOMCustomEvent *custom_event = DOMCustomEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
+    DOMEvent_traverse(&custom_event->event.dispex, cb);
+    traverse_variant(&custom_event->detail, "detail", cb);
+}
+
 static void DOMCustomEvent_unlink(DispatchEx *dispex)
 {
     DOMCustomEvent *custom_event = DOMCustomEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
@@ -2612,6 +2649,13 @@ static void *DOMMessageEvent_query_interface(DOMEvent *event, REFIID riid)
     return NULL;
 }

+static void DOMMessageEvent_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    DOMMessageEvent *message_event = DOMMessageEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
+    DOMEvent_traverse(&message_event->event.dispex, cb);
+    traverse_variant(&message_event->data, "data", cb);
+}
+
 static void DOMMessageEvent_unlink(DispatchEx *dispex)
 {
     DOMMessageEvent *message_event = DOMMessageEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
@@ -2793,6 +2837,14 @@ static void *DOMProgressEvent_query_interface(DOMEvent *event, REFIID riid)
     return NULL;
 }

+static void DOMProgressEvent_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    DOMProgressEvent *This = DOMProgressEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
+    DOMEvent_traverse(&This->event.dispex, cb);
+    if(This->nsevent)
+        note_cc_edge((nsISupports*)This->nsevent, "ProgressEvent.nsevent", cb);
+}
+
 static void DOMProgressEvent_unlink(DispatchEx *dispex)
 {
     DOMProgressEvent *This = DOMProgressEvent_from_DOMEvent(DOMEvent_from_DispatchEx(dispex));
@@ -2968,6 +3020,7 @@ static void DOMStorageEvent_destructor(DispatchEx *dispex)

static const dispex_static_data_vtbl_t DOMEvent_dispex_vtbl = {
     .destructor       = DOMEvent_destructor,
+    .traverse         = DOMEvent_traverse,
     .unlink           = DOMEvent_unlink
 };

@@ -2985,6 +3038,7 @@ static dispex_static_data_t DOMEvent_dispex = {

static const dispex_static_data_vtbl_t DOMUIEvent_dispex_vtbl = {
     .destructor       = DOMEvent_destructor,
+    .traverse         = DOMUIEvent_traverse,
     .unlink           = DOMUIEvent_unlink
 };

@@ -3003,6 +3057,7 @@ static dispex_static_data_t DOMUIEvent_dispex = {

static const dispex_static_data_vtbl_t DOMMouseEvent_dispex_vtbl = {
     .destructor       = DOMEvent_destructor,
+    .traverse         = DOMMouseEvent_traverse,
     .unlink           = DOMMouseEvent_unlink
 };

@@ -3022,6 +3077,7 @@ static dispex_static_data_t DOMMouseEvent_dispex = {

static const dispex_static_data_vtbl_t DOMKeyboardEvent_dispex_vtbl = {
     .destructor       = DOMEvent_destructor,
+    .traverse         = DOMKeyboardEvent_traverse,
     .unlink           = DOMKeyboardEvent_unlink
 };

@@ -3055,6 +3111,7 @@ static dispex_static_data_t DOMPageTransitionEvent_dispex = {

static const dispex_static_data_vtbl_t DOMCustomEvent_dispex_vtbl = {
     .destructor       = DOMCustomEvent_destructor,
+    .traverse         = DOMCustomEvent_traverse,
     .unlink           = DOMCustomEvent_unlink
 };

@@ -3073,6 +3130,7 @@ static dispex_static_data_t DOMCustomEvent_dispex = {

static const dispex_static_data_vtbl_t DOMMessageEvent_dispex_vtbl = {
     .destructor       = DOMMessageEvent_destructor,
+    .traverse         = DOMMessageEvent_traverse,
     .unlink           = DOMMessageEvent_unlink
 };

@@ -3091,6 +3149,7 @@ static dispex_static_data_t DOMMessageEvent_dispex = {

static const dispex_static_data_vtbl_t DOMProgressEvent_dispex_vtbl = {
     .destructor       = DOMEvent_destructor,
+    .traverse         = DOMProgressEvent_traverse,
     .unlink           = DOMProgressEvent_unlink
 };

@@ -3109,6 +3168,7 @@ static dispex_static_data_t DOMProgressEvent_dispex = {

static const dispex_static_data_vtbl_t DOMStorageEvent_dispex_vtbl = {
     .destructor       = DOMStorageEvent_destructor,
+    .traverse         = DOMEvent_traverse,
     .unlink           = DOMEvent_unlink
 };

@@ -3134,7 +3194,6 @@ static void *event_ctor(unsigned size, dispex_static_data_t *dispex_data, void *
         return NULL;
     event->IDOMEvent_iface.lpVtbl = &DOMEventVtbl;
     event->query_interface = query_interface;
-    event->ref = 1;
     event->event_id = event_id;
     if(event_id != EVENTID_LAST) {
         event->type = wcsdup(event_info[event_id].name);
diff --git a/dlls/mshtml/htmlevent.h b/dlls/mshtml/htmlevent.h
index f6c7cbc381b..cf33daa4709 100644
--- a/dlls/mshtml/htmlevent.h
+++ b/dlls/mshtml/htmlevent.h
@@ -76,7 +76,6 @@ typedef struct DOMEvent {
     DispatchEx dispex;
     IDOMEvent IDOMEvent_iface;

-    LONG ref;
     void *(*query_interface)(struct DOMEvent*,REFIID);

nsIDOMEvent *nsevent;