diff --git a/dlls/mshtml/htmldoc.c b/dlls/mshtml/htmldoc.c
index 32da2e032bc..a6aa73f1a35 100644
--- a/dlls/mshtml/htmldoc.c
+++ b/dlls/mshtml/htmldoc.c
@@ -214,8 +214,10 @@ static ULONG WINAPI HTMLDocument_Release(IHTMLDocument2 *iface)
ConnectionPointContainer_Destroy(&This->cp_container);
- if(This->nsdoc)
+ if(This->nsdoc) {
+ remove_mutation_observer(This->nscontainer, This->nsdoc);
nsIDOMHTMLDocument_Release(This->nsdoc);
+ }
if(This->nscontainer)
NSContainer_Release(This->nscontainer);
diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h
index e4c98a72231..b67c4856a93 100644
--- a/dlls/mshtml/mshtml_private.h
+++ b/dlls/mshtml/mshtml_private.h
@@ -510,6 +510,7 @@ void NSContainer_Release(NSContainer*);
void init_mutation(NSContainer*);
void set_mutation_observer(NSContainer*,nsIDOMHTMLDocument*);
+void remove_mutation_observer(NSContainer*,nsIDOMHTMLDocument*);
void HTMLDocument_LockContainer(HTMLDocument*,BOOL);
void show_context_menu(HTMLDocument*,DWORD,POINT*,IDispatch*);
diff --git a/dlls/mshtml/mutation.c b/dlls/mshtml/mutation.c
index ea61d5ad94e..ab9649ca6c1 100644
--- a/dlls/mshtml/mutation.c
+++ b/dlls/mshtml/mutation.c
@@ -55,6 +55,21 @@ void set_mutation_observer(NSContainer *nscontainer, nsIDOMHTMLDocument *nshtmld
nsIDOMNSDocument_Release(nsdoc);
}
+void remove_mutation_observer(NSContainer *nscontainer, nsIDOMHTMLDocument *nshtmldoc)
+{
+ nsIDOMNSDocument *nsdoc;
+ nsresult nsres;
+
+ nsres = nsIDOMHTMLDocument_QueryInterface(nshtmldoc, &IID_nsIDOMNSDocument, (void**)&nsdoc);
+ if(NS_FAILED(nsres)) {
+ ERR("Could not get nsIDOMNSDocument: %08x\n", nsres);
+ return;
+ }
+
+ nsIDOMNSDocument_WineRemoveObserver(nsdoc, NSDOCOBS(nscontainer));
+ nsIDOMNSDocument_Release(nsdoc);
+}
+
#define IE_MAJOR_VERSION 7
#define IE_MINOR_VERSION 0
diff --git a/dlls/mshtml/nsembed.c b/dlls/mshtml/nsembed.c
index ee386accb7c..16ac21ebbd5 100644
--- a/dlls/mshtml/nsembed.c
+++ b/dlls/mshtml/nsembed.c
@@ -857,8 +857,10 @@ void update_nsdocument(HTMLDocument *doc)
return;
}
- if(doc->nsdoc)
+ if(doc->nsdoc) {
+ remove_mutation_observer(doc->nscontainer, doc->nsdoc);
nsIDOMHTMLDocument_Release(doc->nsdoc);
+ }
doc->nsdoc = nsdoc;