From 4e5c4758ff7eb4b683b91709b1d9c950ae1902e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gabriel=20Iv=C4=83ncescu?= <gabrielopcode@gmail.com>
Date: Mon, 25 Oct 2021 16:30:25 +0300
Subject: [PATCH] jscript: Fix some refcount leaks.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In particular, most leak when jsdisp->ctx is not the current ctx.

Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>
Signed-off-by: Jacek Caban <jacek@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
---
 dlls/jscript/dispex.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/dlls/jscript/dispex.c b/dlls/jscript/dispex.c
index c7e4ba933b7..4c57a690f5f 100644
--- a/dlls/jscript/dispex.c
+++ b/dlls/jscript/dispex.c
@@ -2028,6 +2028,7 @@ HRESULT disp_call(script_ctx_t *ctx, IDispatch *disp, DISPID id, WORD flags, uns
     if(jsdisp && jsdisp->ctx == ctx) {
         if(flags & DISPATCH_PROPERTYPUT) {
             FIXME("disp_call(propput) on builtin object\n");
+            jsdisp_release(jsdisp);
             return E_FAIL;
         }
 
@@ -2037,6 +2038,8 @@ HRESULT disp_call(script_ctx_t *ctx, IDispatch *disp, DISPID id, WORD flags, uns
         jsdisp_release(jsdisp);
         return hres;
     }
+    if(jsdisp)
+        jsdisp_release(jsdisp);
 
     flags &= ~DISPATCH_JSCRIPT_INTERNAL_MASK;
     if(ret && argc)
@@ -2106,6 +2109,8 @@ HRESULT disp_call_value(script_ctx_t *ctx, IDispatch *disp, IDispatch *jsthis, W
         jsdisp_release(jsdisp);
         return hres;
     }
+    if(jsdisp)
+        jsdisp_release(jsdisp);
 
     flags &= ~DISPATCH_JSCRIPT_INTERNAL_MASK;
     if(r && argc && flags == DISPATCH_METHOD)
@@ -2205,6 +2210,8 @@ HRESULT disp_propput(script_ctx_t *ctx, IDispatch *disp, DISPID id, jsval_t val)
         VARIANT var;
         DISPPARAMS dp  = {&var, &dispid, 1, 1};
 
+        if(jsdisp)
+            jsdisp_release(jsdisp);
         hres = jsval_to_variant(val, &var);
         if(FAILED(hres))
             return hres;
@@ -2230,6 +2237,8 @@ HRESULT disp_propput_name(script_ctx_t *ctx, IDispatch *disp, const WCHAR *name,
         BSTR str;
         DISPID id;
 
+        if(jsdisp)
+            jsdisp_release(jsdisp);
         if(!(str = SysAllocString(name)))
             return E_OUTOFMEMORY;
 
@@ -2248,7 +2257,9 @@ HRESULT disp_propput_name(script_ctx_t *ctx, IDispatch *disp, const WCHAR *name,
         return disp_propput(ctx, disp, id, val);
     }
 
-    return jsdisp_propput_name(jsdisp, name, val);
+    hres = jsdisp_propput_name(jsdisp, name, val);
+    jsdisp_release(jsdisp);
+    return hres;
 }
 
 HRESULT jsdisp_propget_name(jsdisp_t *obj, const WCHAR *name, jsval_t *val)
@@ -2312,6 +2323,8 @@ HRESULT disp_propget(script_ctx_t *ctx, IDispatch *disp, DISPID id, jsval_t *val
         jsdisp_release(jsdisp);
         return hres;
     }
+    if(jsdisp)
+        jsdisp_release(jsdisp);
 
     V_VT(&var) = VT_EMPTY;
     hres = disp_invoke(ctx, disp, id, INVOKE_PROPERTYGET, &dp, &var);