[PATCH 0/5] MR3257: mshtml: TextRange ref leak fixes.

[PATCH 1/5] mshtml: Introduce helper to transfer node ownership to range points when AddRef isn't needed.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/range.c | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/dlls/mshtml/range.c b/dlls/mshtml/range.c
index 23a42987841..da6b83cbc96 100644
--- a/dlls/mshtml/range.c
+++ b/dlls/mshtml/range.c
@@ -174,15 +174,19 @@ static int get_child_index(nsIDOMNode *parent, nsIDOMNode *child)
     return ret;
 }

-static void init_rangepoint(rangepoint_t *rangepoint, nsIDOMNode *node, UINT32 off)
+static void init_rangepoint_no_addref(rangepoint_t *rangepoint, nsIDOMNode *node, UINT32 off)
 {
-    nsIDOMNode_AddRef(node);
-
     rangepoint->type = get_node_type(node);
     rangepoint->node = node;
     rangepoint->off = off;
 }

+static void init_rangepoint(rangepoint_t *rangepoint, nsIDOMNode *node, UINT32 off)
+{
+    nsIDOMNode_AddRef(node);
+    init_rangepoint_no_addref(rangepoint, node, off);
+}
+
 static inline void free_rangepoint(rangepoint_t *rangepoint)
 {
     nsIDOMNode_Release(rangepoint->node);
@@ -203,8 +207,7 @@ static BOOL rangepoint_next_node(rangepoint_t *iter)
     node = get_child_node(iter->node, iter->off);
     if(node) {
         free_rangepoint(iter);
-        init_rangepoint(iter, node, 0);
-        nsIDOMNode_Release(node);
+        init_rangepoint_no_addref(iter, node, 0);
         return TRUE;
     }

@@ -216,8 +219,7 @@ static BOOL rangepoint_next_node(rangepoint_t *iter)

off = get_child_index(node, iter->node)+1;
     free_rangepoint(iter);
-    init_rangepoint(iter, node, off);
-    nsIDOMNode_Release(node);
+    init_rangepoint_no_addref(iter, node, off);
     return TRUE;
 }

@@ -266,8 +268,7 @@ static BOOL rangepoint_prev_node(rangepoint_t *iter)

off = get_node_type(node) == TEXT_NODE ? get_text_length(node) : get_child_count(node);
         free_rangepoint(iter);
-        init_rangepoint(iter, node, off);
-        nsIDOMNode_Release(node);
+        init_rangepoint_no_addref(iter, node, off);
         return TRUE;
     }

@@ -291,9 +292,7 @@ static void get_start_point(HTMLTxtRange *This, rangepoint_t *ret)
     nsIDOMRange_GetStartContainer(This->nsrange, &node);
     nsIDOMRange_GetStartOffset(This->nsrange, &off);

-    init_rangepoint(ret, node, off);
-
-    nsIDOMNode_Release(node);
+    init_rangepoint_no_addref(ret, node, off);
 }

static void get_end_point(HTMLTxtRange *This, rangepoint_t *ret)
@@ -304,9 +303,7 @@ static void get_end_point(HTMLTxtRange *This, rangepoint_t *ret)
     nsIDOMRange_GetEndContainer(This->nsrange, &node);
     nsIDOMRange_GetEndOffset(This->nsrange, &off);

-    init_rangepoint(ret, node, off);
-
-    nsIDOMNode_Release(node);
+    init_rangepoint_no_addref(ret, node, off);
 }

static void set_start_point(HTMLTxtRange *This, const rangepoint_t *start)

[PATCH 2/5] mshtml: Fix leak when obtaining previous node of range point.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/range.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/mshtml/range.c b/dlls/mshtml/range.c
index da6b83cbc96..e88d8901268 100644
--- a/dlls/mshtml/range.c
+++ b/dlls/mshtml/range.c
@@ -280,7 +280,7 @@ static BOOL rangepoint_prev_node(rangepoint_t *iter)

off = get_child_index(node, iter->node);
     free_rangepoint(iter);
-    init_rangepoint(iter, node, off);
+    init_rangepoint_no_addref(iter, node, off);
     return TRUE;
 }

[PATCH 3/5] mshtml: Fix leak when moving to next char in range point.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/range.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dlls/mshtml/range.c b/dlls/mshtml/range.c
index e88d8901268..5bd6a8414cb 100644
--- a/dlls/mshtml/range.c
+++ b/dlls/mshtml/range.c
@@ -622,6 +622,9 @@ static WCHAR move_next_char(rangepoint_t *iter)
         }
     }while(rangepoint_next_node(iter));

+    if(cspace)
+        free_rangepoint(&last_space);
+
     return cspace;
 }

[PATCH 4/5] mshtml: Fix leak in find_prev_space.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/range.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/dlls/mshtml/range.c b/dlls/mshtml/range.c
index 5bd6a8414cb..89b1eecb8cb 100644
--- a/dlls/mshtml/range.c
+++ b/dlls/mshtml/range.c
@@ -741,8 +741,10 @@ static LONG find_prev_space(rangepoint_t *iter, BOOL first_space)

init_rangepoint(&prev, iter->node, iter->off);
     c = move_prev_char(&prev);
-    if(!c || (first_space && iswspace(c)))
+    if(!c || (first_space && iswspace(c))) {
+        free_rangepoint(&prev);
         return FALSE;
+    }

do {
         free_rangepoint(iter);

[PATCH 5/5] mshtml: Fix text node leak in TextRange's text setter.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/range.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dlls/mshtml/range.c b/dlls/mshtml/range.c
index 89b1eecb8cb..1f062f5022a 100644
--- a/dlls/mshtml/range.c
+++ b/dlls/mshtml/range.c
@@ -969,6 +969,7 @@ static HRESULT WINAPI HTMLTxtRange_put_text(IHTMLTxtRange *iface, BSTR v)
     if(NS_FAILED(nsres))
         ERR("SetEndAfter failed: %08lx\n", nsres);

+    nsIDOMText_Release(text_node);
     return IHTMLTxtRange_collapse(&This->IHTMLTxtRange_iface, VARIANT_FALSE);
 }

[PATCH 0/5] MR3257: mshtml: TextRange ref leak fixes. - approved

[Jacek Caban (＠jacek)]

This merge request was approved by Jacek Caban.