[PATCH v2 0/3] MR7737: mshtml/jscript: Regression + leak fixes.

[Gabriel Ivăncescu (＠insn)]

For some reason I thought it wasn't needed anymore (I had it initially), sorry for the mess up.

--
  v2: jscript: Don't leak when return value of host constructor is not used.
      jscript: Don't leak when popping (u)int values off the stack.
      mshtml: Don't mess with the outer window if we're already detached.

https://gitlab.winehq.org/wine/wine/-/merge_requests/7737

[PATCH v2 1/3] mshtml: Don't mess with the outer window if we're already detached.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Since now we always keep outer_window pointer valid (if it exists), we
could e.g. unlink location props from an already detached inner window. This
restores previous behavior on detach.

Fixes a regression introduced by 7c11ce8d44f1758a855c4d3c976825f8afe5fbb2.

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlwindow.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/mshtml/htmlwindow.c b/dlls/mshtml/htmlwindow.c
index e685da74c03..ffcaf86a361 100644
--- a/dlls/mshtml/htmlwindow.c
+++ b/dlls/mshtml/htmlwindow.c
@@ -108,7 +108,7 @@ static inline HRESULT get_window_event(HTMLWindow *window, eventid_t eid, VARIAN

static void detach_inner_window(HTMLInnerWindow *window)
 {
-    HTMLOuterWindow *outer_window = window->base.outer_window;
+    HTMLOuterWindow *outer_window = is_detached_window(window) ? NULL : window->base.outer_window;
     HTMLDocumentNode *doc = window->doc, *doc_iter;

while(!list_empty(&window->children)) {

[PATCH v2 2/3] jscript: Don't leak when popping (u)int values off the stack.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/jscript/engine.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/dlls/jscript/engine.c b/dlls/jscript/engine.c
index d36567826dc..243b922c8f1 100644
--- a/dlls/jscript/engine.c
+++ b/dlls/jscript/engine.c
@@ -142,12 +142,24 @@ static HRESULT stack_pop_object(script_ctx_t *ctx, IDispatch **r)

static inline HRESULT stack_pop_int(script_ctx_t *ctx, INT *r)
 {
-    return to_int32(ctx, stack_pop(ctx), r);
+    jsval_t v;
+    HRESULT hres;
+
+    v = stack_pop(ctx);
+    hres = to_int32(ctx, v, r);
+    jsval_release(v);
+    return hres;
 }

static inline HRESULT stack_pop_uint(script_ctx_t *ctx, UINT32 *r)
 {
-    return to_uint32(ctx, stack_pop(ctx), r);
+    jsval_t v;
+    HRESULT hres;
+
+    v = stack_pop(ctx);
+    hres = to_uint32(ctx, v, r);
+    jsval_release(v);
+    return hres;
 }

static inline unsigned local_off(call_frame_t *frame, int ref)

[PATCH v2 3/3] jscript: Don't leak when return value of host constructor is not used.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/jscript/function.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/jscript/function.c b/dlls/jscript/function.c
index 848ee657dc2..9f1f53a96ae 100644
--- a/dlls/jscript/function.c
+++ b/dlls/jscript/function.c
@@ -1146,8 +1146,8 @@ static HRESULT HostConstructor_call(script_ctx_t *ctx, FunctionInstance *func, j
                                              &ctx->jscaller->IServiceProvider_iface);
         if(hres == DISP_E_EXCEPTION)
             handle_dispatch_exception(ctx, &ei);
-        if(SUCCEEDED(hres) && r) {
-            hres = variant_to_jsval(ctx, &ret, r);
+        if(SUCCEEDED(hres)) {
+            if(r) hres = variant_to_jsval(ctx, &ret, r);
             VariantClear(&ret);
         }
     }

[PATCH v2 0/3] MR7737: mshtml/jscript: Regression + leak fixes. - approved

[Jacek Caban (＠jacek)]

This merge request was approved by Jacek Caban.