mshtml: Store inner window directly in HTMLDocumentNode.

dlls/mshtml/htmldoc.c

@@ -2091,8 +2091,13 @@ static void HTMLDocumentNode_destructor(HTMLDOMNode *iface)
         detach_plugin_host(LIST_ENTRY(list_head(&This->plugin_hosts), PluginHost, entry));
 
     if(This->nsdoc) {
+        assert(!This->window);
         release_document_mutation(This);
         nsIDOMHTMLDocument_Release(This->nsdoc);
+    }else if(This->window) {
+        /* document fragments own reference to inner window */
+        IHTMLWindow2_Release(&This->window->base.IHTMLWindow2_iface);
+        This->window = NULL;
     }
 
     heap_free(This->event_vector);
@@ -2124,6 +2129,7 @@ static void HTMLDocumentNode_unlink(HTMLDOMNode *iface)
         release_document_mutation(This);
         This->nsdoc = NULL;
         nsIDOMHTMLDocument_Release(nsdoc);
+        This->window = NULL;
     }
 }
 
@@ -2238,7 +2244,7 @@ static dispex_static_data_t HTMLDocumentNode_dispex = {
     HTMLDocumentNode_iface_tids
 };
 
-static HTMLDocumentNode *alloc_doc_node(HTMLDocumentObj *doc_obj, HTMLOuterWindow *window)
+static HTMLDocumentNode *alloc_doc_node(HTMLDocumentObj *doc_obj, HTMLInnerWindow *window)
 {
     HTMLDocumentNode *doc;
 
@@ -2249,7 +2255,8 @@ static HTMLDocumentNode *alloc_doc_node(HTMLDocumentObj *doc_obj, HTMLOuterWindo
     doc->ref = 1;
     doc->basedoc.doc_node = doc;
     doc->basedoc.doc_obj = doc_obj;
-    doc->basedoc.window = window;
+    doc->basedoc.window = window->base.outer_window;
+    doc->window = window;
 
     init_dispex(&doc->node.dispex, (IUnknown*)&doc->node.IHTMLDOMNode_iface,
             &HTMLDocumentNode_dispex);
@@ -2264,7 +2271,7 @@ static HTMLDocumentNode *alloc_doc_node(HTMLDocumentObj *doc_obj, HTMLOuterWindo
     return doc;
 }
 
-HRESULT create_doc_from_nsdoc(nsIDOMHTMLDocument *nsdoc, HTMLDocumentObj *doc_obj, HTMLOuterWindow *window, HTMLDocumentNode **ret)
+HRESULT create_doc_from_nsdoc(nsIDOMHTMLDocument *nsdoc, HTMLDocumentObj *doc_obj, HTMLInnerWindow *window, HTMLDocumentNode **ret)
 {
     HTMLDocumentNode *doc;
 
@@ -2272,7 +2279,7 @@ HRESULT create_doc_from_nsdoc(nsIDOMHTMLDocument *nsdoc, HTMLDocumentObj *doc_ob
     if(!doc)
         return E_OUTOFMEMORY;
 
-    if(!doc_obj->basedoc.window || window == doc_obj->basedoc.window)
+    if(!doc_obj->basedoc.window || window->base.outer_window == doc_obj->basedoc.window)
         doc->basedoc.cp_container.forward_container = &doc_obj->basedoc.cp_container;
 
     HTMLDOMNode_Init(doc, &doc->node, (nsIDOMNode*)nsdoc);
@@ -2294,10 +2301,12 @@ HRESULT create_document_fragment(nsIDOMNode *nsnode, HTMLDocumentNode *doc_node,
 {
     HTMLDocumentNode *doc_frag;
 
-    doc_frag = alloc_doc_node(doc_node->basedoc.doc_obj, doc_node->basedoc.window);
+    doc_frag = alloc_doc_node(doc_node->basedoc.doc_obj, doc_node->window);
     if(!doc_frag)
         return E_OUTOFMEMORY;
 
+    IHTMLWindow2_AddRef(&doc_frag->window->base.IHTMLWindow2_iface);
+
     HTMLDOMNode_Init(doc_node, &doc_frag->node, nsnode);
     doc_frag->node.vtbl = &HTMLDocumentFragmentImplVtbl;
     doc_frag->node.cp_container = &doc_frag->basedoc.cp_container;

dlls/mshtml/htmlwindow.c

@@ -239,8 +239,10 @@ static void release_inner_window(HTMLInnerWindow *This)
     abort_window_bindings(This);
     release_script_hosts(This);
 
-    if(This->doc)
+    if(This->doc) {
+        This->doc->window = NULL;
         htmldoc_release(&This->doc->basedoc);
+    }
 
     release_dispex(&This->dispex);
 
@@ -2745,7 +2747,7 @@ HRESULT update_window_doc(HTMLInnerWindow *window)
         return E_FAIL;
     }
 
-    hres = create_doc_from_nsdoc(nshtmldoc, outer_window->doc_obj, outer_window, &window->doc);
+    hres = create_doc_from_nsdoc(nshtmldoc, outer_window->doc_obj, window, &window->doc);
     nsIDOMHTMLDocument_Release(nshtmldoc);
     if(FAILED(hres))
         return hres;

dlls/mshtml/mshtml_private.h

@@ -679,6 +679,8 @@ struct HTMLDocumentNode {
 
     LONG ref;
 
+    HTMLInnerWindow *window;
+
     nsIDOMHTMLDocument *nsdoc;
     BOOL content_ready;
     event_target_t *body_event_target;
@@ -700,7 +702,7 @@ struct HTMLDocumentNode {
 
 HRESULT HTMLDocument_Create(IUnknown*,REFIID,void**) DECLSPEC_HIDDEN;
 HRESULT HTMLLoadOptions_Create(IUnknown*,REFIID,void**) DECLSPEC_HIDDEN;
-HRESULT create_doc_from_nsdoc(nsIDOMHTMLDocument*,HTMLDocumentObj*,HTMLOuterWindow*,HTMLDocumentNode**) DECLSPEC_HIDDEN;
+HRESULT create_doc_from_nsdoc(nsIDOMHTMLDocument*,HTMLDocumentObj*,HTMLInnerWindow*,HTMLDocumentNode**) DECLSPEC_HIDDEN;
 HRESULT create_document_fragment(nsIDOMNode*,HTMLDocumentNode*,HTMLDocumentNode**) DECLSPEC_HIDDEN;
 
 HRESULT HTMLOuterWindow_Create(HTMLDocumentObj*,nsIDOMWindow*,HTMLOuterWindow*,HTMLOuterWindow**) DECLSPEC_HIDDEN;