From bf9dc5b3ed2aa9f905e57835abff3cd29431de94 Mon Sep 17 00:00:00 2001
From: Jacek Caban <jacek@codeweavers.com>
Date: Mon, 11 Mar 2019 14:22:44 +0100
Subject: [PATCH] mshtml: Detach more document objects in detach_inner_window.

Signed-off-by: Jacek Caban <jacek@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
---
 dlls/mshtml/htmldoc.c        | 50 +++++++++++++++++++++---------------
 dlls/mshtml/htmlwindow.c     |  8 +++---
 dlls/mshtml/mshtml_private.h |  1 +
 3 files changed, 33 insertions(+), 26 deletions(-)

diff --git a/dlls/mshtml/htmldoc.c b/dlls/mshtml/htmldoc.c
index 722f26c43f7..100dc9716ff 100644
--- a/dlls/mshtml/htmldoc.c
+++ b/dlls/mshtml/htmldoc.c
@@ -4885,31 +4885,39 @@ static HRESULT HTMLDocumentNode_QI(HTMLDOMNode *iface, REFIID riid, void **ppv)
     return S_OK;
 }
 
+void detach_document_node(HTMLDocumentNode *doc)
+{
+    unsigned i;
+
+    while(!list_empty(&doc->plugin_hosts))
+        detach_plugin_host(LIST_ENTRY(list_head(&doc->plugin_hosts), PluginHost, entry));
+
+    detach_events(doc);
+    detach_selection(doc);
+    detach_ranges(doc);
+
+    for(i=0; i < doc->elem_vars_cnt; i++)
+        heap_free(doc->elem_vars[i]);
+    heap_free(doc->elem_vars);
+    doc->elem_vars_cnt = 0;
+
+    if(doc->catmgr) {
+        ICatInformation_Release(doc->catmgr);
+        doc->catmgr = NULL;
+    }
+
+    if(!doc->nsdoc && doc->window) {
+        /* document fragments own reference to inner window */
+        IHTMLWindow2_Release(&doc->window->base.IHTMLWindow2_iface);
+        doc->window = NULL;
+    }
+}
+
 static void HTMLDocumentNode_destructor(HTMLDOMNode *iface)
 {
     HTMLDocumentNode *This = impl_from_HTMLDOMNode(iface);
-    unsigned i;
-
-    for(i=0; i < This->elem_vars_cnt; i++)
-        heap_free(This->elem_vars[i]);
-    heap_free(This->elem_vars);
-
-    detach_events(This);
-    if(This->catmgr)
-        ICatInformation_Release(This->catmgr);
-
-    detach_selection(This);
-    detach_ranges(This);
-
-    while(!list_empty(&This->plugin_hosts))
-        detach_plugin_host(LIST_ENTRY(list_head(&This->plugin_hosts), PluginHost, entry));
-
-    if(!This->nsdoc && This->window) {
-        /* document fragments own reference to inner window */
-        IHTMLWindow2_Release(&This->window->base.IHTMLWindow2_iface);
-        This->window = NULL;
-    }
 
+    detach_document_node(This);
     heap_free(This->event_vector);
     ConnectionPointContainer_Destroy(&This->basedoc.cp_container);
 }
diff --git a/dlls/mshtml/htmlwindow.c b/dlls/mshtml/htmlwindow.c
index 41df57f8e28..ffd44249791 100644
--- a/dlls/mshtml/htmlwindow.c
+++ b/dlls/mshtml/htmlwindow.c
@@ -126,15 +126,13 @@ static inline HRESULT get_window_event(HTMLWindow *window, eventid_t eid, VARIAN
 static void detach_inner_window(HTMLInnerWindow *window)
 {
     HTMLOuterWindow *outer_window = window->base.outer_window;
+    HTMLDocumentNode *doc = window->doc;
 
     if(outer_window && outer_window->doc_obj && outer_window == outer_window->doc_obj->basedoc.window)
         window->doc->basedoc.cp_container.forward_container = NULL;
 
-    if(window->doc) {
-        detach_events(window->doc);
-        while(!list_empty(&window->doc->plugin_hosts))
-            detach_plugin_host(LIST_ENTRY(list_head(&window->doc->plugin_hosts), PluginHost, entry));
-    }
+    if(doc)
+        detach_document_node(doc);
 
     abort_window_bindings(window);
     remove_target_tasks(window->task_magic);
diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h
index a0b3feaeba2..cef745e6f33 100644
--- a/dlls/mshtml/mshtml_private.h
+++ b/dlls/mshtml/mshtml_private.h
@@ -975,6 +975,7 @@ HRESULT HTMLTxtRange_Create(HTMLDocumentNode*,nsIDOMRange*,IHTMLTxtRange**) DECL
 IHTMLStyleSheet *HTMLStyleSheet_Create(nsIDOMStyleSheet*) DECLSPEC_HIDDEN;
 IHTMLStyleSheetsCollection *HTMLStyleSheetsCollection_Create(nsIDOMStyleSheetList*) DECLSPEC_HIDDEN;
 
+void detach_document_node(HTMLDocumentNode*) DECLSPEC_HIDDEN;
 void detach_selection(HTMLDocumentNode*) DECLSPEC_HIDDEN;
 void detach_ranges(HTMLDocumentNode*) DECLSPEC_HIDDEN;
 HRESULT get_node_text(HTMLDOMNode*,BSTR*) DECLSPEC_HIDDEN;