From 21e1b15795d3d34ebea1eef1066e80ef7d7b26c9 Mon Sep 17 00:00:00 2001
From: Jacek Caban <jacek@codeweavers.com>
Date: Thu, 5 Feb 2009 21:18:16 +0100
Subject: [PATCH] mshtml: Remove document observer before releasing nsdoc.

---
 dlls/mshtml/htmldoc.c        |  4 +++-
 dlls/mshtml/mshtml_private.h |  1 +
 dlls/mshtml/mutation.c       | 15 +++++++++++++++
 dlls/mshtml/nsembed.c        |  4 +++-
 4 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/dlls/mshtml/htmldoc.c b/dlls/mshtml/htmldoc.c
index 32da2e032bc..a6aa73f1a35 100644
--- a/dlls/mshtml/htmldoc.c
+++ b/dlls/mshtml/htmldoc.c
@@ -214,8 +214,10 @@ static ULONG WINAPI HTMLDocument_Release(IHTMLDocument2 *iface)
 
         ConnectionPointContainer_Destroy(&This->cp_container);
 
-        if(This->nsdoc)
+        if(This->nsdoc) {
+            remove_mutation_observer(This->nscontainer, This->nsdoc);
             nsIDOMHTMLDocument_Release(This->nsdoc);
+        }
         if(This->nscontainer)
             NSContainer_Release(This->nscontainer);
 
diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h
index e4c98a72231..b67c4856a93 100644
--- a/dlls/mshtml/mshtml_private.h
+++ b/dlls/mshtml/mshtml_private.h
@@ -510,6 +510,7 @@ void NSContainer_Release(NSContainer*);
 
 void init_mutation(NSContainer*);
 void set_mutation_observer(NSContainer*,nsIDOMHTMLDocument*);
+void remove_mutation_observer(NSContainer*,nsIDOMHTMLDocument*);
 
 void HTMLDocument_LockContainer(HTMLDocument*,BOOL);
 void show_context_menu(HTMLDocument*,DWORD,POINT*,IDispatch*);
diff --git a/dlls/mshtml/mutation.c b/dlls/mshtml/mutation.c
index ea61d5ad94e..ab9649ca6c1 100644
--- a/dlls/mshtml/mutation.c
+++ b/dlls/mshtml/mutation.c
@@ -55,6 +55,21 @@ void set_mutation_observer(NSContainer *nscontainer, nsIDOMHTMLDocument *nshtmld
     nsIDOMNSDocument_Release(nsdoc);
 }
 
+void remove_mutation_observer(NSContainer *nscontainer, nsIDOMHTMLDocument *nshtmldoc)
+{
+    nsIDOMNSDocument *nsdoc;
+    nsresult nsres;
+
+    nsres = nsIDOMHTMLDocument_QueryInterface(nshtmldoc, &IID_nsIDOMNSDocument, (void**)&nsdoc);
+    if(NS_FAILED(nsres)) {
+        ERR("Could not get nsIDOMNSDocument: %08x\n", nsres);
+        return;
+    }
+
+    nsIDOMNSDocument_WineRemoveObserver(nsdoc, NSDOCOBS(nscontainer));
+    nsIDOMNSDocument_Release(nsdoc);
+}
+
 #define IE_MAJOR_VERSION 7
 #define IE_MINOR_VERSION 0
 
diff --git a/dlls/mshtml/nsembed.c b/dlls/mshtml/nsembed.c
index ee386accb7c..16ac21ebbd5 100644
--- a/dlls/mshtml/nsembed.c
+++ b/dlls/mshtml/nsembed.c
@@ -857,8 +857,10 @@ void update_nsdocument(HTMLDocument *doc)
         return;
     }
 
-    if(doc->nsdoc)
+    if(doc->nsdoc) {
+        remove_mutation_observer(doc->nscontainer, doc->nsdoc);
         nsIDOMHTMLDocument_Release(doc->nsdoc);
+    }
 
     doc->nsdoc = nsdoc;