[PATCH 0/3] MR7737: mshtml/jscript: Regression + leak fixes.

[Gabriel Ivăncescu (＠insn)]

For some reason I thought it wasn't needed anymore (I had it initially), sorry for the mess up.

[PATCH 1/3] mshtml: Don't mess with the outer window if we're already detached.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Since now we always keep outer_window pointer valid (if it exists), we
could e.g. unlink location props from an already detached inner window. This
restores previous behavior on detach.

Fixes a regression introduced by 7c11ce8d44f1758a855c4d3c976825f8afe5fbb2.

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/htmlwindow.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/mshtml/htmlwindow.c b/dlls/mshtml/htmlwindow.c
index e685da74c03..ffcaf86a361 100644
--- a/dlls/mshtml/htmlwindow.c
+++ b/dlls/mshtml/htmlwindow.c
@@ -108,7 +108,7 @@ static inline HRESULT get_window_event(HTMLWindow *window, eventid_t eid, VARIAN

static void detach_inner_window(HTMLInnerWindow *window)
 {
-    HTMLOuterWindow *outer_window = window->base.outer_window;
+    HTMLOuterWindow *outer_window = is_detached_window(window) ? NULL : window->base.outer_window;
     HTMLDocumentNode *doc = window->doc, *doc_iter;

while(!list_empty(&window->children)) {

[PATCH 2/3] jscript: Don't leak when popping (u)int values off the stack.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/jscript/engine.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/dlls/jscript/engine.c b/dlls/jscript/engine.c
index d36567826dc..243b922c8f1 100644
--- a/dlls/jscript/engine.c
+++ b/dlls/jscript/engine.c
@@ -142,12 +142,24 @@ static HRESULT stack_pop_object(script_ctx_t *ctx, IDispatch **r)

static inline HRESULT stack_pop_int(script_ctx_t *ctx, INT *r)
 {
-    return to_int32(ctx, stack_pop(ctx), r);
+    jsval_t v;
+    HRESULT hres;
+
+    v = stack_pop(ctx);
+    hres = to_int32(ctx, v, r);
+    jsval_release(v);
+    return hres;
 }

static inline HRESULT stack_pop_uint(script_ctx_t *ctx, UINT32 *r)
 {
-    return to_uint32(ctx, stack_pop(ctx), r);
+    jsval_t v;
+    HRESULT hres;
+
+    v = stack_pop(ctx);
+    hres = to_uint32(ctx, v, r);
+    jsval_release(v);
+    return hres;
 }

static inline unsigned local_off(call_frame_t *frame, int ref)

[PATCH 3/3] jscript: Don't leak when return value of host constructor is not used.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/jscript/function.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/jscript/function.c b/dlls/jscript/function.c
index 848ee657dc2..11ff9861246 100644
--- a/dlls/jscript/function.c
+++ b/dlls/jscript/function.c
@@ -1142,8 +1142,8 @@ static HRESULT HostConstructor_call(script_ctx_t *ctx, FunctionInstance *func, j

if(SUCCEEDED(hres)) {
         V_VT(&ret) = VT_EMPTY;
-        hres = IWineJSDispatchHost_Construct(function->host_iface, ctx->lcid, flags, &dp, &ret, &ei,
-                                             &ctx->jscaller->IServiceProvider_iface);
+        hres = IWineJSDispatchHost_Construct(function->host_iface, ctx->lcid, flags, &dp, r ? &ret : NULL,
+                                             &ei, &ctx->jscaller->IServiceProvider_iface);
         if(hres == DISP_E_EXCEPTION)
             handle_dispatch_exception(ctx, &ei);
         if(SUCCEEDED(hres) && r) {

[Jacek Caban (＠jacek)]

Jacek Caban (@jacek) commented about dlls/jscript/function.c:
>  if(SUCCEEDED(hres)) {
>      V_VT(&ret) = VT_EMPTY;
> -
>    hres = IWineJSDispatchHost_Construct(function->host_iface, ctx->lcid, flags, &dp, &ret, &ei,
> -
>                                         &ctx->jscaller->IServiceProvider_iface);
> -
>    hres = IWineJSDispatchHost_Construct(function->host_iface, ctx->lcid, flags, &dp, r ? &ret : NULL,
> -
>                                         &ei, &ctx->jscaller->IServiceProvider_iface);

It doesn't seem right to pass NULL constructor result, I think we should fix error handling instead and always clear the variant on success.

[Gabriel Ivăncescu (＠insn)]

On Thu Apr  3 18:53:29 2025 +0000, Jacek Caban wrote:
> It doesn't seem right to pass NULL constructor result, I think we should
> fix error handling instead and always clear the variant on success.

Oh I was just following the same pattern from `CallFunction`, but yeah
it doesn't make much sense for constructor to not return something.