mshtml: Remove document observer before releasing nsdoc.

dlls/mshtml/htmldoc.c

@@ -214,8 +214,10 @@ static ULONG WINAPI HTMLDocument_Release(IHTMLDocument2 *iface)
 
         ConnectionPointContainer_Destroy(&This->cp_container);
 
-        if(This->nsdoc)
+        if(This->nsdoc) {
+            remove_mutation_observer(This->nscontainer, This->nsdoc);
             nsIDOMHTMLDocument_Release(This->nsdoc);
+        }
         if(This->nscontainer)
             NSContainer_Release(This->nscontainer);
 

dlls/mshtml/mshtml_private.h

@@ -510,6 +510,7 @@ void NSContainer_Release(NSContainer*);
 
 void init_mutation(NSContainer*);
 void set_mutation_observer(NSContainer*,nsIDOMHTMLDocument*);
+void remove_mutation_observer(NSContainer*,nsIDOMHTMLDocument*);
 
 void HTMLDocument_LockContainer(HTMLDocument*,BOOL);
 void show_context_menu(HTMLDocument*,DWORD,POINT*,IDispatch*);

dlls/mshtml/mutation.c

@@ -55,6 +55,21 @@ void set_mutation_observer(NSContainer *nscontainer, nsIDOMHTMLDocument *nshtmld
     nsIDOMNSDocument_Release(nsdoc);
 }
 
+void remove_mutation_observer(NSContainer *nscontainer, nsIDOMHTMLDocument *nshtmldoc)
+{
+    nsIDOMNSDocument *nsdoc;
+    nsresult nsres;
+
+    nsres = nsIDOMHTMLDocument_QueryInterface(nshtmldoc, &IID_nsIDOMNSDocument, (void**)&nsdoc);
+    if(NS_FAILED(nsres)) {
+        ERR("Could not get nsIDOMNSDocument: %08x\n", nsres);
+        return;
+    }
+
+    nsIDOMNSDocument_WineRemoveObserver(nsdoc, NSDOCOBS(nscontainer));
+    nsIDOMNSDocument_Release(nsdoc);
+}
+
 #define IE_MAJOR_VERSION 7
 #define IE_MINOR_VERSION 0
 

dlls/mshtml/nsembed.c

@@ -857,8 +857,10 @@ void update_nsdocument(HTMLDocument *doc)
         return;
     }
 
-    if(doc->nsdoc)
+    if(doc->nsdoc) {
+        remove_mutation_observer(doc->nscontainer, doc->nsdoc);
         nsIDOMHTMLDocument_Release(doc->nsdoc);
+    }
 
     doc->nsdoc = nsdoc;