mshtml: Store weak GeckoBrowser reference in HTMLDocumentNode.

dlls/mshtml/htmldoc.c

@@ -4911,6 +4911,11 @@ void detach_document_node(HTMLDocumentNode *doc)
         IHTMLWindow2_Release(&doc->window->base.IHTMLWindow2_iface);
         doc->window = NULL;
     }
+
+    if(doc->browser) {
+        list_remove(&doc->browser_entry);
+        doc->browser = NULL;
+    }
 }
 
 static void HTMLDocumentNode_destructor(HTMLDOMNode *iface)
@@ -5194,6 +5199,9 @@ HRESULT create_document_node(nsIDOMHTMLDocument *nsdoc, GeckoBrowser *browser, H
 
     doc->node.vtbl = &HTMLDocumentNodeImplVtbl;
 
+    list_add_head(&browser->document_nodes, &doc->browser_entry);
+    doc->browser = browser;
+
     *ret = doc;
     return S_OK;
 }

dlls/mshtml/mshtml_private.h

@@ -722,6 +722,8 @@ struct GeckoBrowser {
     nsIURIContentListener *content_listener;
 
     HWND hwnd;
+
+    struct list document_nodes;
 };
 
 typedef struct {
@@ -830,6 +832,9 @@ struct HTMLDocumentNode {
 
     HTMLInnerWindow *window;
 
+    GeckoBrowser *browser;
+    struct list browser_entry;
+
     compat_mode_t document_mode;
     BOOL document_mode_locked;
 

dlls/mshtml/nsembed.c

@@ -1359,6 +1359,8 @@ static nsrefcnt NSAPI nsWebBrowserChrome_Release(nsIWebBrowserChrome *iface)
     TRACE("(%p) ref=%d\n", This, ref);
 
     if(!ref) {
+        if(This->doc)
+            detach_gecko_browser(This);
         if(This->weak_reference) {
             This->weak_reference->browser = NULL;
             nsIWeakReference_Release(&This->weak_reference->nsIWeakReference_iface);
@@ -2155,6 +2157,7 @@ HRESULT create_gecko_browser(HTMLDocumentObj *doc, GeckoBrowser **_ret)
 
     ret->doc = doc;
     ret->ref = 1;
+    list_init(&ret->document_nodes);
 
     hres = init_browser(ret);
     if(SUCCEEDED(hres))
@@ -2170,6 +2173,12 @@ void detach_gecko_browser(GeckoBrowser *This)
 
     This->doc = NULL;
 
+    while(!list_empty(&This->document_nodes)) {
+        HTMLDocumentNode *doc = LIST_ENTRY(list_head(&This->document_nodes), HTMLDocumentNode, browser_entry);
+        list_remove(&doc->browser_entry);
+        doc->browser = NULL;
+    }
+
     ShowWindow(This->hwnd, SW_HIDE);
     SetParent(This->hwnd, NULL);