[PATCH 0/10] MR3134: mshtml: More ref leak fixes.

[PATCH 01/10] mshtml: Traverse and unlink AreaElements properly.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlarea.c | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/dlls/mshtml/htmlarea.c b/dlls/mshtml/htmlarea.c
index eb7ea383db9..c518432519d 100644
--- a/dlls/mshtml/htmlarea.c
+++ b/dlls/mshtml/htmlarea.c
@@ -461,6 +461,26 @@ fallback:
     return HTMLElement_handle_event(&This->element.node, eid, event, prevent_default);
 }

+static void HTMLAreaElement_traverse(HTMLDOMNode *iface, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLAreaElement *This = impl_from_HTMLDOMNode(iface);
+
+    if(This->nsarea)
+        note_cc_edge((nsISupports*)This->nsarea, "nsarea", cb);
+}
+
+static void HTMLAreaElement_unlink(HTMLDOMNode *iface)
+{
+    HTMLAreaElement *This = impl_from_HTMLDOMNode(iface);
+
+    if(This->nsarea) {
+        nsIDOMHTMLAreaElement *nsarea = This->nsarea;
+
+        This->nsarea = NULL;
+        nsIDOMHTMLAreaElement_Release(nsarea);
+    }
+}
+
 static const NodeImplVtbl HTMLAreaElementImplVtbl = {
     &CLSID_HTMLAreaElement,
     HTMLAreaElement_QI,
@@ -468,7 +488,18 @@ static const NodeImplVtbl HTMLAreaElementImplVtbl = {
     HTMLElement_cpc,
     HTMLElement_clone,
     HTMLAreaElement_handle_event,
-    HTMLElement_get_attr_col
+    HTMLElement_get_attr_col,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    HTMLAreaElement_traverse,
+    HTMLAreaElement_unlink
 };

static const tid_t HTMLAreaElement_iface_tids[] = {

[PATCH 02/10] mshtml: Fix style declaration leak in HTMLStyle_Create.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlstyle.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dlls/mshtml/htmlstyle.c b/dlls/mshtml/htmlstyle.c
index 703fbeeb942..c8dc69bb2af 100644
--- a/dlls/mshtml/htmlstyle.c
+++ b/dlls/mshtml/htmlstyle.c
@@ -10099,6 +10099,7 @@ HRESULT HTMLStyle_Create(HTMLElement *elem, HTMLStyle **ret)

init_css_style(&style->css_style, nsstyle, HTMLStyle_QI, &HTMLStyle_dispex,
                    dispex_compat_mode(&elem->node.event_target.dispex));
+    nsIDOMCSSStyleDeclaration_Release(nsstyle);

*ret = style;
     return S_OK;

[PATCH 03/10] mshtml: Fix nsIDOMNode leak when retrieving an item in the node list.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlnode.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dlls/mshtml/htmlnode.c b/dlls/mshtml/htmlnode.c
index 02f3e2929b2..f15718f1b90 100644
--- a/dlls/mshtml/htmlnode.c
+++ b/dlls/mshtml/htmlnode.c
@@ -338,6 +338,7 @@ static HRESULT WINAPI HTMLDOMChildrenCollection_item(IHTMLDOMChildrenCollection
     }

hres = get_node(nsnode, TRUE, &node);
+    nsIDOMNode_Release(nsnode);
     if(FAILED(hres))
         return hres;

[PATCH 04/10] mshtml: Fix node leak when enumerating nodes.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

get_node already adds a ref.

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlnode.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dlls/mshtml/htmlnode.c b/dlls/mshtml/htmlnode.c
index f15718f1b90..c967f2f474b 100644
--- a/dlls/mshtml/htmlnode.c
+++ b/dlls/mshtml/htmlnode.c
@@ -140,7 +140,6 @@ static HRESULT WINAPI HTMLDOMChildrenCollectionEnum_Next(IEnumVARIANT *iface, UL
         }

V_VT(rgVar+fetched) = VT_DISPATCH;
-        IHTMLDOMNode_AddRef(&node->IHTMLDOMNode_iface);
         V_DISPATCH(rgVar+fetched) = (IDispatch*)&node->IHTMLDOMNode_iface;
         fetched++;
     }

[PATCH 05/10] mshtml: Handle failure and cleanup properly when enumerating nodes.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlnode.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dlls/mshtml/htmlnode.c b/dlls/mshtml/htmlnode.c
index c967f2f474b..b29383ad9ff 100644
--- a/dlls/mshtml/htmlnode.c
+++ b/dlls/mshtml/htmlnode.c
@@ -135,8 +135,9 @@ static HRESULT WINAPI HTMLDOMChildrenCollectionEnum_Next(IEnumVARIANT *iface, UL
         hres = get_node(nsnode, TRUE, &node);
         nsIDOMNode_Release(nsnode);
         if(FAILED(hres)) {
-            ERR("get_node failed: %08lx\n", hres);
-            break;
+            while(fetched--)
+                VariantClear(rgVar+fetched);
+            return hres;
         }

V_VT(rgVar+fetched) = VT_DISPATCH;

[PATCH 06/10] mshtml: Fix leaks in create_all_list.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlelemcol.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/dlls/mshtml/htmlelemcol.c b/dlls/mshtml/htmlelemcol.c
index 6172bc2d57e..75c86a8b4dd 100644
--- a/dlls/mshtml/htmlelemcol.c
+++ b/dlls/mshtml/htmlelemcol.c
@@ -656,8 +656,6 @@ static void create_all_list(HTMLDOMNode *elem, elem_vector_t *buf)
     }

nsIDOMNodeList_GetLength(nsnode_list, &list_len);
-    if(!list_len)
-        return;

for(i=0; i<list_len; i++) {
         nsres = nsIDOMNodeList_Item(nsnode_list, i, &iter);
@@ -672,13 +670,18 @@ static void create_all_list(HTMLDOMNode *elem, elem_vector_t *buf)
             hres = get_node(iter, TRUE, &node);
             if(FAILED(hres)) {
                 FIXME("get_node failed: %08lx\n", hres);
+                nsIDOMNode_Release(iter);
                 continue;
             }

elem_vector_add(buf, elem_from_HTMLDOMNode(node));
             create_all_list(node, buf);
         }
+
+        nsIDOMNode_Release(iter);
     }
+
+    nsIDOMNodeList_Release(nsnode_list);
 }

IHTMLElementCollection *create_all_collection(HTMLDOMNode *node, BOOL include_root)

[PATCH 07/10] mshtml: Fix element leaks in get_elem_source_index.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlelemcol.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/dlls/mshtml/htmlelemcol.c b/dlls/mshtml/htmlelemcol.c
index 75c86a8b4dd..75ee079e3c7 100644
--- a/dlls/mshtml/htmlelemcol.c
+++ b/dlls/mshtml/htmlelemcol.c
@@ -778,8 +778,8 @@ HRESULT get_elem_source_index(HTMLElement *elem, LONG *ret)
     nsIDOMNode *parent_node, *iter;
     UINT16 parent_type;
     HTMLDOMNode *node;
-    int i;
     nsresult nsres;
+    unsigned i, j;
     HRESULT hres;

iter = elem->node.nsnode;
@@ -830,7 +830,11 @@ HRESULT get_elem_source_index(HTMLElement *elem, LONG *ret)
             break;
     }
     IHTMLDOMNode_Release(&node->IHTMLDOMNode_iface);
+
+    for(j = 0; j < buf.len; j++)
+        IHTMLDOMNode_Release(&buf.buf[j]->node.IHTMLDOMNode_iface);
     free(buf.buf);
+
     if(i == buf.len) {
         FIXME("The element is not in parent's child list?\n");
         return E_UNEXPECTED;

[PATCH 08/10] mshtml: Fix text node leak in Element innerText setter.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlelem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dlls/mshtml/htmlelem.c b/dlls/mshtml/htmlelem.c
index 5dd812c9ca6..ad5bda63665 100644
--- a/dlls/mshtml/htmlelem.c
+++ b/dlls/mshtml/htmlelem.c
@@ -2339,6 +2339,7 @@ static HRESULT WINAPI HTMLElement_put_innerText(IHTMLElement *iface, BSTR v)
     }

nsres = nsIDOMElement_AppendChild(This->dom_element, (nsIDOMNode*)text_node, &tmp);
+    nsIDOMText_Release(text_node);
     if(NS_FAILED(nsres)) {
         ERR("AppendChild failed: %08lx\n", nsres);
         return E_FAIL;

[PATCH 09/10] mshtml: Fix text node leak in OptionElement text setter.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlselect.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dlls/mshtml/htmlselect.c b/dlls/mshtml/htmlselect.c
index 5b904c86d4b..bbe6fadebba 100644
--- a/dlls/mshtml/htmlselect.c
+++ b/dlls/mshtml/htmlselect.c
@@ -283,6 +283,7 @@ static HRESULT WINAPI HTMLOptionElement_put_text(IHTMLOptionElement *iface, BSTR
     }

nsres = nsIDOMElement_AppendChild(This->element.dom_element, (nsIDOMNode*)text_node, &tmp);
+    nsIDOMText_Release(text_node);
     if(NS_SUCCEEDED(nsres))
         nsIDOMNode_Release(tmp);
     else

[PATCH 10/10] mshtml/tests: Fix CurrentStyle leak in test_style_filters.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/tests/style.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dlls/mshtml/tests/style.c b/dlls/mshtml/tests/style.c
index b0f6da47fea..8d33b85af84 100644
--- a/dlls/mshtml/tests/style.c
+++ b/dlls/mshtml/tests/style.c
@@ -3424,6 +3424,7 @@ static void test_style_filters(IHTMLElement *elem)
     ok(hres == S_OK, "get_style failed: %08lx\n", hres);

current_style2 = get_current_style2_iface((IUnknown*)current_style);
+    IHTMLCurrentStyle_Release(current_style);

test_style_filter(style, NULL);
     test_current_style_filter(current_style2, NULL);

[PATCH 0/10] MR3134: mshtml: More ref leak fixes. - approved

[Jacek Caban (＠jacek)]

This merge request was approved by Jacek Caban.