mshtml: Release the event target during node unlink.

The event target can participate in a cycle. Also since release_event_target can now potentially be called multiple times, we have to NULL the rb tree to make it re-entrant safe. Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>

mshtml: Release the event target during node unlink.
76f622a6 · Gabriel Ivăncescu · Alexandre Julliard · a54b322f · 76f622a6 · 76f622a6
Commit 76f622a6 authored Aug 15, 2023 by Gabriel Ivăncescu Committed by Alexandre Julliard Aug 16, 2023
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 2 deletions

htmlevent.c dlls/mshtml/htmlevent.c +2 -1

htmlnode.c dlls/mshtml/htmlnode.c +1 -1

No files found.
--- a/dlls/mshtml/htmlevent.c
+++ b/dlls/mshtml/htmlevent.c
@@ -4552,11 +4552,12 @@ void release_event_target(EventTarget *event_target)
    WINE_RB_FOR_EACH_ENTRY_DESTRUCTOR(iter, iter2, &event_target->handler_map, listener_container_t, entry) {
        while(!list_empty(&iter->listeners)) {
            event_listener_t *listener = LIST_ENTRY(list_head(&iter->listeners), event_listener_t, entry);
+            list_remove(&listener->entry);
            if(listener->function)
                IDispatch_Release(listener->function);
-            list_remove(&listener->entry);
            free(listener);
        }
        free(iter);
    }
+    rb_destroy(&event_target->handler_map, NULL, NULL);
 }
--- a/dlls/mshtml/htmlnode.c
+++ b/dlls/mshtml/htmlnode.c
@@ -1443,6 +1443,7 @@ void HTMLDOMNode_unlink(DispatchEx *dispex)
    if(This->vtbl->unlink)
        This->vtbl->unlink(This);

+    release_event_target(&This->event_target);
    unlink_ref(&This->nsnode);

    if(This->doc) {
@@ -1456,7 +1457,6 @@ void HTMLDOMNode_unlink(DispatchEx *dispex)
 void HTMLDOMNode_destructor(DispatchEx *dispex)
 {
    HTMLDOMNode *This = HTMLDOMNode_from_DispatchEx(dispex);
-    release_event_target(&This->event_target);
    if(This->vtbl->destructor)
        This->vtbl->destructor(This);
    free(This);