mshtml: Keep reference in node returned from get_node.

dlls/mshtml/htmldoc.c

@@ -138,9 +138,12 @@ static HRESULT WINAPI HTMLDocument_get_all(IHTMLDocument2 *iface, IHTMLElementCo
     }
 
     hres = get_node(This->doc_node, (nsIDOMNode*)nselem, TRUE, &node);
-    if(SUCCEEDED(hres))
-        *p = create_all_collection(node, TRUE);
     nsIDOMElement_Release(nselem);
+    if(FAILED(hres))
+        return hres;
+
+    *p = create_all_collection(node, TRUE);
+    node_release(node);
     return hres;
 }
 
@@ -173,7 +176,9 @@ static HRESULT WINAPI HTMLDocument_get_body(IHTMLDocument2 *iface, IHTMLElement
     if(FAILED(hres))
         return hres;
 
-    return IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_IHTMLElement, (void**)p);
+    hres = IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_IHTMLElement, (void**)p);
+    node_release(node);
+    return hres;
 }
 
 static HRESULT WINAPI HTMLDocument_get_activeElement(IHTMLDocument2 *iface, IHTMLElement **p)
@@ -1349,7 +1354,9 @@ static HRESULT WINAPI HTMLDocument_elementFromPoint(IHTMLDocument2 *iface, LONG
     if(FAILED(hres))
         return hres;
 
-    return IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_IHTMLElement, (void**)elementHit);
+    hres = IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_IHTMLElement, (void**)elementHit);
+    node_release(node);
+    return hres;
 }
 
 static HRESULT WINAPI HTMLDocument_get_parentWindow(IHTMLDocument2 *iface, IHTMLWindow2 **p)
@@ -2156,7 +2163,6 @@ static HRESULT HTMLDocumentNode_invoke(DispatchEx *dispex, DISPID id, LCID lcid,
     if(FAILED(hres))
         return hres;
 
-    IHTMLDOMNode_AddRef(&node->IHTMLDOMNode_iface);
     V_VT(res) = VT_DISPATCH;
     V_DISPATCH(res) = (IDispatch*)&node->IHTMLDOMNode_iface;
     return S_OK;

dlls/mshtml/htmldoc3.c

@@ -175,7 +175,9 @@ static HRESULT WINAPI HTMLDocument3_get_documentElement(IHTMLDocument3 *iface, I
     if(FAILED(hres))
         return hres;
 
-    return IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_IHTMLElement, (void**)p);
+    hres = IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_IHTMLElement, (void**)p);
+    node_release(node);
+    return hres;
 }
 
 static HRESULT WINAPI HTMLDocument3_uniqueID(IHTMLDocument3 *iface, BSTR *p)
@@ -532,9 +534,10 @@ static HRESULT WINAPI HTMLDocument3_getElementById(IHTMLDocument3 *iface, BSTR v
         hres = get_node(This->doc_node, nsnode, TRUE, &node);
         nsIDOMNode_Release(nsnode);
 
-        if(SUCCEEDED(hres))
-            hres = IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_IHTMLElement,
-                    (void**)pel);
+        if(SUCCEEDED(hres)) {
+            hres = IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_IHTMLElement, (void**)pel);
+            node_release(node);
+        }
     }else {
         *pel = NULL;
         hres = S_OK;

dlls/mshtml/htmlelem.c

@@ -920,6 +920,7 @@ static HRESULT WINAPI HTMLElement_get_offsetParent(IHTMLElement *iface, IHTMLEle
             return hres;
 
         hres = IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_IHTMLElement, (void**)p);
+        node_release(node);
     }else {
         *p = NULL;
         hres = S_OK;

dlls/mshtml/htmlelemcol.c

@@ -522,6 +522,7 @@ static void create_all_list(HTMLDocumentNode *doc, HTMLDOMNode *elem, elem_vecto
 
             elem_vector_add(buf, elem_from_HTMLDOMNode(node));
             create_all_list(doc, node, buf);
+            node_release(node);
         }
     }
 }
@@ -563,6 +564,7 @@ IHTMLElementCollection *create_collection_from_nodelist(HTMLDocumentNode *doc, I
                 if(FAILED(hres))
                     continue;
                 buf.buf[buf.len++] = elem_from_HTMLDOMNode(node);
+                node_release(node);
             }
             nsIDOMNode_Release(nsnode);
         }
@@ -597,6 +599,7 @@ IHTMLElementCollection *create_collection_from_htmlcol(HTMLDocumentNode *doc, IU
             if(FAILED(hres))
                 break;
             buf.buf[i] = elem_from_HTMLDOMNode(node);
+            node_release(node);
         }
     }else {
         buf.buf = NULL;

dlls/mshtml/htmlevent.c

@@ -1003,6 +1003,7 @@ void fire_event(HTMLDocumentNode *doc, eventid_t eid, BOOL set_event, nsIDOMNode
             return;
 
         event_obj = create_event(node, eid, nsevent);
+        node_release(node);
         doc->basedoc.window->event = &event_obj->IHTMLEventObj_iface;
     }else {
         doc->basedoc.window->event = NULL;
@@ -1016,9 +1017,11 @@ void fire_event(HTMLDocumentNode *doc, eventid_t eid, BOOL set_event, nsIDOMNode
     case ELEMENT_NODE:
         do {
             hres = get_node(doc, nsnode, FALSE, &node);
-            if(SUCCEEDED(hres) && node)
+            if(SUCCEEDED(hres) && node) {
                 call_event_handlers(doc, event_obj, *get_node_event_target(node),
                         node->cp_container, eid, (IDispatch*)&node->IHTMLDOMNode_iface);
+                node_release(node);
+            }
 
             if(!(event_info[eid].flags & EVENT_BUBBLE) || (event_obj && event_obj->cancel_bubble))
                 break;
@@ -1043,9 +1046,11 @@ void fire_event(HTMLDocumentNode *doc, eventid_t eid, BOOL set_event, nsIDOMNode
             nsres = nsIDOMHTMLDocument_GetBody(doc->nsdoc, &nsbody);
             if(NS_SUCCEEDED(nsres) && nsbody) {
                 hres = get_node(doc, (nsIDOMNode*)nsbody, FALSE, &node);
-                if(SUCCEEDED(hres) && node)
+                if(SUCCEEDED(hres) && node) {
                     call_event_handlers(doc, event_obj, *get_node_event_target(node),
                             node->cp_container, eid, (IDispatch*)&node->IHTMLDOMNode_iface);
+                    node_release(node);
+                }
                 nsIDOMHTMLElement_Release(nsbody);
             }else {
                 ERR("Could not get body: %08x\n", nsres);
@@ -1078,8 +1083,10 @@ void fire_event(HTMLDocumentNode *doc, eventid_t eid, BOOL set_event, nsIDOMNode
             if(FAILED(hres))
                 break;
 
-            if(node && node->vtbl->handle_event) {
-                hres = node->vtbl->handle_event(node, eid, nsevent, &prevent_default);
+            if(node) {
+                if(node->vtbl->handle_event)
+                    hres = node->vtbl->handle_event(node, eid, nsevent, &prevent_default);
+                node_release(node);
                 if(FAILED(hres) || prevent_default || (event_obj && event_obj->cancel_bubble))
                     break;
             }
@@ -1382,8 +1389,10 @@ void check_event_attr(HTMLDocumentNode *doc, nsIDOMElement *nselem)
             disp = script_parse_event(doc->basedoc.window, attr_value);
             if(disp) {
                 hres = get_node(doc, (nsIDOMNode*)nselem, TRUE, &node);
-                if(SUCCEEDED(hres))
+                if(SUCCEEDED(hres)) {
                     set_event_handler_disp(get_node_event_target(node), node->nsnode, node->doc, i, disp);
+                    node_release(node);
+                }
                 IDispatch_Release(disp);
             }
         }

dlls/mshtml/htmlform.c

@@ -66,7 +66,6 @@ static HRESULT htmlform_item(HTMLFormElement *This, int i, IDispatch **ret)
         if(FAILED(hres))
             return hres;
 
-        IHTMLDOMNode_AddRef(&node->IHTMLDOMNode_iface);
         nsIDOMNode_Release(item);
         *ret = (IDispatch*)&node->IHTMLDOMNode_iface;
     }else {

dlls/mshtml/htmlnode.c

@@ -182,7 +182,6 @@ static HRESULT WINAPI HTMLDOMChildrenCollection_item(IHTMLDOMChildrenCollection
         return hres;
 
     *ppItem = (IDispatch*)&node->IHTMLDOMNode_iface;
-    IDispatch_AddRef(*ppItem);
     return S_OK;
 }
 
@@ -429,7 +428,6 @@ static HRESULT WINAPI HTMLDOMNode_get_parentNode(IHTMLDOMNode *iface, IHTMLDOMNo
         return hres;
 
     *p = &node->IHTMLDOMNode_iface;
-    IHTMLDOMNode_AddRef(*p);
     return S_OK;
 }
 
@@ -540,7 +538,6 @@ static HRESULT WINAPI HTMLDOMNode_insertBefore(IHTMLDOMNode *iface, IHTMLDOMNode
         return hres;
 
     *node = &node_obj->IHTMLDOMNode_iface;
-    IHTMLDOMNode_AddRef(*node);
     return S_OK;
 }
 
@@ -572,7 +569,6 @@ static HRESULT WINAPI HTMLDOMNode_removeChild(IHTMLDOMNode *iface, IHTMLDOMNode
 
     /* FIXME: Make sure that node != newChild */
     *node = &node_obj->IHTMLDOMNode_iface;
-    IHTMLDOMNode_AddRef(*node);
     return S_OK;
 }
 
@@ -609,7 +605,6 @@ static HRESULT WINAPI HTMLDOMNode_replaceChild(IHTMLDOMNode *iface, IHTMLDOMNode
         return hres;
 
     *node = &node_new->IHTMLDOMNode_iface;
-    IHTMLDOMNode_AddRef(*node);
     return S_OK;
 }
 
@@ -690,7 +685,6 @@ static HRESULT WINAPI HTMLDOMNode_appendChild(IHTMLDOMNode *iface, IHTMLDOMNode
 
     /* FIXME: Make sure that node != newChild */
     *node = &node_obj->IHTMLDOMNode_iface;
-    IHTMLDOMNode_AddRef(*node);
     return S_OK;
 }
 
@@ -776,7 +770,6 @@ static HRESULT WINAPI HTMLDOMNode_get_firstChild(IHTMLDOMNode *iface, IHTMLDOMNo
         return hres;
 
     *p = &node->IHTMLDOMNode_iface;
-    IHTMLDOMNode_AddRef(*p);
     return S_OK;
 }
 
@@ -801,7 +794,6 @@ static HRESULT WINAPI HTMLDOMNode_get_lastChild(IHTMLDOMNode *iface, IHTMLDOMNod
         return hres;
 
     *p = &node->IHTMLDOMNode_iface;
-    IHTMLDOMNode_AddRef(*p);
     return S_OK;
 }
 
@@ -826,7 +818,6 @@ static HRESULT WINAPI HTMLDOMNode_get_previousSibling(IHTMLDOMNode *iface, IHTML
         return hres;
 
     *p = &node->IHTMLDOMNode_iface;
-    IHTMLDOMNode_AddRef(*p);
     return S_OK;
 }
 
@@ -851,7 +842,6 @@ static HRESULT WINAPI HTMLDOMNode_get_nextSibling(IHTMLDOMNode *iface, IHTMLDOMN
         return hres;
 
     *p = &node->IHTMLDOMNode_iface;
-    IHTMLDOMNode_AddRef(*p);
     return S_OK;
 }
 
@@ -1106,6 +1096,7 @@ static HRESULT create_node(HTMLDocumentNode *doc, nsIDOMNode *nsnode, HTMLDOMNod
 HRESULT get_node(HTMLDocumentNode *This, nsIDOMNode *nsnode, BOOL create, HTMLDOMNode **ret)
 {
     HTMLDOMNode *iter = This->nodes;
+    HRESULT hres;
 
     while(iter) {
         if(iter->nsnode == nsnode)
@@ -1114,11 +1105,16 @@ HRESULT get_node(HTMLDocumentNode *This, nsIDOMNode *nsnode, BOOL create, HTMLDO
     }
 
     if(iter || !create) {
+        if(iter)
+            IHTMLDOMNode_AddRef(&iter->IHTMLDOMNode_iface);
         *ret = iter;
         return S_OK;
     }
 
-    return create_node(This, nsnode, ret);
+    hres = create_node(This, nsnode, ret);
+    if(SUCCEEDED(hres))
+        IHTMLDOMNode_AddRef(&(*ret)->IHTMLDOMNode_iface);
+    return hres;
 }
 
 /*

dlls/mshtml/htmloption.c

@@ -486,6 +486,7 @@ static HRESULT WINAPI HTMLOptionElementFactory_create(IHTMLOptionElementFactory
 
     hres = IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface,
             &IID_IHTMLOptionElement, (void**)optelem);
+    node_release(node);
 
     if(V_VT(&text) == VT_BSTR)
         IHTMLOptionElement_put_text(*optelem, V_BSTR(&text));

dlls/mshtml/htmlselect.c

@@ -73,7 +73,6 @@ static HRESULT htmlselect_item(HTMLSelectElement *This, int i, IDispatch **ret)
         if(FAILED(hres))
             return hres;
 
-        IHTMLDOMNode_AddRef(&node->IHTMLDOMNode_iface);
         *ret = (IDispatch*)&node->IHTMLDOMNode_iface;
     }else {
         *ret = NULL;

dlls/mshtml/mshtml_private.h

@@ -556,6 +556,11 @@ struct HTMLDOMNode {
     HTMLDOMNode *next;
 };
 
+static inline void node_release(HTMLDOMNode *node)
+{
+    IHTMLDOMNode_Release(&node->IHTMLDOMNode_iface);
+}
+
 typedef struct {
     HTMLDOMNode node;
     ConnectionPointContainer cp_container;

dlls/mshtml/mutation.c

@@ -228,6 +228,7 @@ static nsresult run_bind_to_tree(HTMLDocumentNode *doc, nsISupports *nsiface, ns
     if(node->vtbl->bind_to_tree)
         node->vtbl->bind_to_tree(node);
 
+    node_release(node);
     return nsres;
 }
 

dlls/mshtml/nsembed.c

@@ -1287,6 +1287,7 @@ static nsresult NSAPI nsContextMenuListener_OnShowContextMenu(nsIContextMenuList
         return NS_ERROR_FAILURE;
 
     show_context_menu(This->doc, dwID, &pt, (IDispatch*)&node->IHTMLDOMNode_iface);
+    node_release(node);
     return NS_OK;
 }
 

dlls/mshtml/pluginhost.c

@@ -1239,6 +1239,7 @@ static HRESULT assoc_element(PluginHost *host, HTMLDocumentNode *doc, nsIDOMElem
 
     hres = IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_HTMLPluginContainer,
             (void**)&container_elem);
+    node_release(node);
     if(FAILED(hres)) {
         ERR("Not an object element\n");
         return hres;

dlls/mshtml/txtrange.c

@@ -1211,7 +1211,9 @@ static HRESULT WINAPI HTMLTxtRange_parentElement(IHTMLTxtRange *iface, IHTMLElem
     if(FAILED(hres))
         return hres;
 
-    return IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_IHTMLElement, (void**)parent);
+    hres = IHTMLDOMNode_QueryInterface(&node->IHTMLDOMNode_iface, &IID_IHTMLElement, (void**)parent);
+    node_release(node);
+    return hres;
 }
 
 static HRESULT WINAPI HTMLTxtRange_duplicate(IHTMLTxtRange *iface, IHTMLTxtRange **Duplicate)