[PATCH 0/5] MR1818: jscript/mshtml: Ref leak fixes.

[PATCH 1/5] mshtml: Fix document fragment's inner window leak.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Document fragments own reference to the inner window, so it must be unlinked.

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmldoc.c | 35 ++++++++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/dlls/mshtml/htmldoc.c b/dlls/mshtml/htmldoc.c
index 49640cff9da..90c4706abee 100644
--- a/dlls/mshtml/htmldoc.c
+++ b/dlls/mshtml/htmldoc.c
@@ -5846,12 +5846,6 @@ void detach_document_node(HTMLDocumentNode *doc)
         doc->catmgr = NULL;
     }

-    if(!doc->dom_document && doc->window) {
-        /* document fragments own reference to inner window */
-        IHTMLWindow2_Release(&doc->window->base.IHTMLWindow2_iface);
-        doc->window = NULL;
-    }
-
     if(doc->browser) {
         list_remove(&doc->browser_entry);
         doc->browser = NULL;
@@ -5935,6 +5929,19 @@ static HRESULT HTMLDocumentFragment_clone(HTMLDOMNode *iface, nsIDOMNode *nsnode
     return S_OK;
 }

+static void HTMLDocumentFragment_unlink(HTMLDOMNode *iface)
+{
+    HTMLDocumentNode *This = impl_from_HTMLDOMNode(iface);
+
+    if(This->window) {
+        detach_document_node(This);
+
+        /* document fragments own reference to inner window */
+        IHTMLWindow2_Release(&This->window->base.IHTMLWindow2_iface);
+        This->window = NULL;
+    }
+}
+
 static inline HTMLDocumentNode *impl_from_DispatchEx(DispatchEx *iface)
 {
     return CONTAINING_RECORD(iface, HTMLDocumentNode, node.event_target.dispex);
@@ -6134,7 +6141,21 @@ static const NodeImplVtbl HTMLDocumentFragmentImplVtbl = {
     HTMLDocumentNode_QI,
     HTMLDocumentNode_destructor,
     HTMLDocumentNode_cpc,
-    HTMLDocumentFragment_clone
+    HTMLDocumentFragment_clone,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    HTMLDocumentFragment_unlink
 };

static const tid_t HTMLDocumentNode_iface_tids[] = {

[PATCH 2/5] mshtml: Fix previous EventObj leak.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlevent.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/dlls/mshtml/htmlevent.c b/dlls/mshtml/htmlevent.c
index 45db4719b10..bcde9f38bba 100644
--- a/dlls/mshtml/htmlevent.c
+++ b/dlls/mshtml/htmlevent.c
@@ -3683,11 +3683,14 @@ static HRESULT dispatch_event_object(EventTarget *event_target, DOMEvent *event,
         *r = variant_bool(!event->prevent_default);

if(target_vtbl && target_vtbl->set_current_event) {
-        prev_event = target_vtbl->set_current_event(&event_target->dispex, prev_event);
-        if(prev_event)
-            IHTMLEventObj_Release(prev_event);
+        IHTMLEventObj *prev = target_vtbl->set_current_event(&event_target->dispex, prev_event);
+        if(prev)
+            IHTMLEventObj_Release(prev);
     }

+    if(prev_event)
+        IHTMLEventObj_Release(prev_event);
+
     if(event_info[event->event_id].flags & EVENT_HASDEFAULTHANDLERS) {
         BOOL prevent_default = event->prevent_default;
         for(i = 0; !prevent_default && i < chain_cnt; i++) {

[PATCH 3/5] jscript: Release converted args after invoking.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/jscript/dispex.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dlls/jscript/dispex.c b/dlls/jscript/dispex.c
index 04632f4c755..06e44fcb129 100644
--- a/dlls/jscript/dispex.c
+++ b/dlls/jscript/dispex.c
@@ -1937,6 +1937,8 @@ static HRESULT WINAPI DispatchEx_InvokeEx(IDispatchEx *iface, DISPID id, LCID lc
         else
             hres = jsdisp_call_value(This, passed_this ? jsval_disp(passed_this) : jsval_undefined(), wFlags, argc, argv, pvarRes ? &r : NULL);

+        while(argc--)
+            jsval_release(argv[argc]);
         if(argv != buf)
             free(argv);
         if(SUCCEEDED(hres) && pvarRes) {

[PATCH 4/5] jscript: Fix array ref leak when setting element.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/jscript/engine.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/jscript/engine.c b/dlls/jscript/engine.c
index 28ada7e53bd..b0557065e69 100644
--- a/dlls/jscript/engine.c
+++ b/dlls/jscript/engine.c
@@ -1684,7 +1684,7 @@ static HRESULT interp_carray_set(script_ctx_t *ctx)
     array = stack_top(ctx);
     assert(is_object_instance(array));

-    hres = jsdisp_propput_idx(iface_to_jsdisp(get_object(array)), index, value);
+    hres = jsdisp_propput_idx(to_jsdisp(get_object(array)), index, value);
     jsval_release(value);
     return hres;
 }

[PATCH 5/5] jscript: Fix refcount trace's long type format specifier.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/jscript/dispex.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/jscript/dispex.c b/dlls/jscript/dispex.c
index 06e44fcb129..2c35f2ae9cc 100644
--- a/dlls/jscript/dispex.c
+++ b/dlls/jscript/dispex.c
@@ -2247,7 +2247,7 @@ void jsdisp_free(jsdisp_t *obj)
 jsdisp_t *jsdisp_addref(jsdisp_t *jsdisp)
 {
     ULONG ref = ++jsdisp->ref;
-    TRACE("(%p) ref=%d\n", jsdisp, ref);
+    TRACE("(%p) ref=%ld\n", jsdisp, ref);
     return jsdisp;
 }

@@ -2255,7 +2255,7 @@ void jsdisp_release(jsdisp_t *jsdisp)
 {
     ULONG ref = --jsdisp->ref;

-    TRACE("(%p) ref=%d\n", jsdisp, ref);
+    TRACE("(%p) ref=%ld\n", jsdisp, ref);

if(!ref)
         jsdisp_free(jsdisp);

[PATCH 0/5] MR1818: jscript/mshtml: Ref leak fixes. - approved

[Jacek Caban (＠jacek)]

This merge request was approved by Jacek Caban.