mshtml: Don't assume that HTMLWindow_Create sets ret val before succeeding.

dlls/mshtml/htmldoc.c

@@ -2019,7 +2019,7 @@ HRESULT create_doc_from_nsdoc(nsIDOMHTMLDocument *nsdoc, HTMLDocumentObj *doc_ob
     if(!doc)
         return E_OUTOFMEMORY;
 
-    if(window == doc_obj->basedoc.window)
+    if(!doc_obj->basedoc.window || window == doc_obj->basedoc.window)
         doc->basedoc.cp_container.forward_container = &doc_obj->basedoc.cp_container;
 
     nsIDOMHTMLDocument_AddRef(nsdoc);

dlls/mshtml/htmlwindow.c

@@ -2247,7 +2247,6 @@ HRESULT HTMLWindow_Create(HTMLDocumentObj *doc_obj, nsIDOMWindow *nswindow, HTML
     list_init(&window->script_hosts);
 
     window->task_magic = get_task_target_magic();
-    *ret = window;
     update_window_doc(window);
 
     list_init(&window->children);
@@ -2260,6 +2259,7 @@ HRESULT HTMLWindow_Create(HTMLDocumentObj *doc_obj, nsIDOMWindow *nswindow, HTML
         list_add_tail(&parent->children, &window->sibling_entry);
     }
 
+    *ret = window;
     return S_OK;
 }