From d2a97e73eb9c05feebe0c0becc67f3c771f3285c Mon Sep 17 00:00:00 2001
From: Jacek Caban <jacek@codeweavers.com>
Date: Thu, 25 Sep 2014 12:11:52 +0200
Subject: [PATCH] mshtml: Don't share nscell reference with nsnode.

---
 dlls/mshtml/htmltablecell.c | 38 ++++++++++++++++++++++++++++++++-----
 1 file changed, 33 insertions(+), 5 deletions(-)

diff --git a/dlls/mshtml/htmltablecell.c b/dlls/mshtml/htmltablecell.c
index 4bcde181c5d..3d3fdb28086 100644
--- a/dlls/mshtml/htmltablecell.c
+++ b/dlls/mshtml/htmltablecell.c
@@ -398,13 +398,44 @@ static void HTMLTableCell_destructor(HTMLDOMNode *iface)
     HTMLElement_destructor(&This->element.node);
 }
 
+static void HTMLTableCell_traverse(HTMLDOMNode *iface, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLTableCell *This = impl_from_HTMLDOMNode(iface);
+
+    if(This->nscell)
+        note_cc_edge((nsISupports*)This->nscell, "This->nstablecell", cb);
+}
+
+static void HTMLTableCell_unlink(HTMLDOMNode *iface)
+{
+    HTMLTableCell *This = impl_from_HTMLDOMNode(iface);
+
+    if(This->nscell) {
+        nsIDOMHTMLTableCellElement *nscell = This->nscell;
+
+        This->nscell = NULL;
+        nsIDOMHTMLTableCellElement_Release(nscell);
+    }
+}
+
 static const NodeImplVtbl HTMLTableCellImplVtbl = {
     HTMLTableCell_QI,
     HTMLTableCell_destructor,
     HTMLElement_cpc,
     HTMLElement_clone,
     HTMLElement_handle_event,
-    HTMLElement_get_attr_col
+    HTMLElement_get_attr_col,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    HTMLTableCell_traverse,
+    HTMLTableCell_unlink
 };
 
 static const tid_t HTMLTableCell_iface_tids[] = {
@@ -435,10 +466,7 @@ HRESULT HTMLTableCell_Create(HTMLDocumentNode *doc, nsIDOMHTMLElement *nselem, H
     HTMLElement_Init(&ret->element, doc, nselem, &HTMLTableCell_dispex);
 
     nsres = nsIDOMHTMLElement_QueryInterface(nselem, &IID_nsIDOMHTMLTableCellElement, (void**)&ret->nscell);
-
-    /* Share nscell reference with nsnode */
-    assert(nsres == NS_OK && (nsIDOMNode*)ret->nscell == ret->element.node.nsnode);
-    nsIDOMNode_Release(ret->element.node.nsnode);
+    assert(nsres == NS_OK);
 
     *elem = &ret->element;
     return S_OK;