From 5e581621ab55be8658a495d867086f0ee221cc94 Mon Sep 17 00:00:00 2001
From: Jacek Caban <jacek@codeweavers.com>
Date: Mon, 11 Mar 2019 14:24:26 +0100
Subject: [PATCH] mshtml: Store weak GeckoBrowser reference in
 HTMLDocumentNode.

Signed-off-by: Jacek Caban <jacek@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
---
 dlls/mshtml/htmldoc.c        | 8 ++++++++
 dlls/mshtml/mshtml_private.h | 5 +++++
 dlls/mshtml/nsembed.c        | 9 +++++++++
 3 files changed, 22 insertions(+)

diff --git a/dlls/mshtml/htmldoc.c b/dlls/mshtml/htmldoc.c
index 7478785116e..afb4a8a97ae 100644
--- a/dlls/mshtml/htmldoc.c
+++ b/dlls/mshtml/htmldoc.c
@@ -4911,6 +4911,11 @@ void detach_document_node(HTMLDocumentNode *doc)
         IHTMLWindow2_Release(&doc->window->base.IHTMLWindow2_iface);
         doc->window = NULL;
     }
+
+    if(doc->browser) {
+        list_remove(&doc->browser_entry);
+        doc->browser = NULL;
+    }
 }
 
 static void HTMLDocumentNode_destructor(HTMLDOMNode *iface)
@@ -5194,6 +5199,9 @@ HRESULT create_document_node(nsIDOMHTMLDocument *nsdoc, GeckoBrowser *browser, H
 
     doc->node.vtbl = &HTMLDocumentNodeImplVtbl;
 
+    list_add_head(&browser->document_nodes, &doc->browser_entry);
+    doc->browser = browser;
+
     *ret = doc;
     return S_OK;
 }
diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h
index 93265d67ed0..2808ca9afcd 100644
--- a/dlls/mshtml/mshtml_private.h
+++ b/dlls/mshtml/mshtml_private.h
@@ -722,6 +722,8 @@ struct GeckoBrowser {
     nsIURIContentListener *content_listener;
 
     HWND hwnd;
+
+    struct list document_nodes;
 };
 
 typedef struct {
@@ -830,6 +832,9 @@ struct HTMLDocumentNode {
 
     HTMLInnerWindow *window;
 
+    GeckoBrowser *browser;
+    struct list browser_entry;
+
     compat_mode_t document_mode;
     BOOL document_mode_locked;
 
diff --git a/dlls/mshtml/nsembed.c b/dlls/mshtml/nsembed.c
index fb0d2b8a5cc..49bbbfd3153 100644
--- a/dlls/mshtml/nsembed.c
+++ b/dlls/mshtml/nsembed.c
@@ -1359,6 +1359,8 @@ static nsrefcnt NSAPI nsWebBrowserChrome_Release(nsIWebBrowserChrome *iface)
     TRACE("(%p) ref=%d\n", This, ref);
 
     if(!ref) {
+        if(This->doc)
+            detach_gecko_browser(This);
         if(This->weak_reference) {
             This->weak_reference->browser = NULL;
             nsIWeakReference_Release(&This->weak_reference->nsIWeakReference_iface);
@@ -2155,6 +2157,7 @@ HRESULT create_gecko_browser(HTMLDocumentObj *doc, GeckoBrowser **_ret)
 
     ret->doc = doc;
     ret->ref = 1;
+    list_init(&ret->document_nodes);
 
     hres = init_browser(ret);
     if(SUCCEEDED(hres))
@@ -2170,6 +2173,12 @@ void detach_gecko_browser(GeckoBrowser *This)
 
     This->doc = NULL;
 
+    while(!list_empty(&This->document_nodes)) {
+        HTMLDocumentNode *doc = LIST_ENTRY(list_head(&This->document_nodes), HTMLDocumentNode, browser_entry);
+        list_remove(&doc->browser_entry);
+        doc->browser = NULL;
+    }
+
     ShowWindow(This->hwnd, SW_HIDE);
     SetParent(This->hwnd, NULL);