mshtml: Hold ref to the frame element during readyState notifications.

Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>

mshtml: Hold ref to the frame element during readyState notifications.
3c2b4171 · Gabriel Ivăncescu · Alexandre Julliard · b7d75c9d · 3c2b4171
Commit 3c2b4171 authored Mar 08, 2023 by Gabriel Ivăncescu Committed by Alexandre Julliard Mar 09, 2023
Hide whitespace changes
Inline Side-by-side

Showing with 7 additions and 3 deletions

persist.c dlls/mshtml/persist.c +7 -3

No files found.
--- a/dlls/mshtml/persist.c
+++ b/dlls/mshtml/persist.c
@@ -438,12 +438,15 @@ HRESULT set_moniker(HTMLOuterWindow *window, IMoniker *mon, IUri *nav_uri, IBind
 static void notif_readystate(HTMLOuterWindow *window)
 {
    HTMLInnerWindow *inner_window = window->base.inner_window;
+    HTMLFrameBase *frame_element = window->frame_element;
    DOMEvent *event;
    HRESULT hres;

    window->readystate_pending = FALSE;

    IHTMLWindow2_AddRef(&inner_window->base.IHTMLWindow2_iface);
+    if(frame_element)
+        IHTMLDOMNode_AddRef(&frame_element->element.node.IHTMLDOMNode_iface);

    if(is_main_content_window(window))
        call_property_onchanged(&window->browser->doc->cp_container, DISPID_READYSTATE);
@@ -456,12 +459,13 @@ static void notif_readystate(HTMLOuterWindow *window)
    }
    IHTMLWindow2_Release(&inner_window->base.IHTMLWindow2_iface);

-    if(window->frame_element) {
-        hres = create_document_event(window->frame_element->element.node.doc, EVENTID_READYSTATECHANGE, &event);
+    if(frame_element) {
+        hres = create_document_event(frame_element->element.node.doc, EVENTID_READYSTATECHANGE, &event);
        if(SUCCEEDED(hres)) {
-            dispatch_event(&window->frame_element->element.node.event_target, event);
+            dispatch_event(&frame_element->element.node.event_target, event);
            IDOMEvent_Release(&event->IDOMEvent_iface);
        }
+        IHTMLDOMNode_Release(&frame_element->element.node.IHTMLDOMNode_iface);
    }
 }