mshtml: Keep reference to document node in onload event handler.

dlls/mshtml/nsevents.c

@@ -235,6 +235,7 @@ static nsresult NSAPI handle_load(nsIDOMEventListener *iface, nsIDOMEvent *event
     HTMLDocumentNode *doc = This->This->doc;
     nsIDOMHTMLElement *nsbody = NULL;
     HTMLDocumentObj *doc_obj = NULL;
+    nsresult nsres = NS_OK;
 
     TRACE("(%p)\n", doc);
 
@@ -245,6 +246,8 @@ static nsresult NSAPI handle_load(nsIDOMEventListener *iface, nsIDOMEvent *event
 
     connect_scripts(doc->window);
 
+    htmldoc_addref(&doc->basedoc);
+
     if(doc_obj)
         handle_docobj_load(doc_obj);
 
@@ -264,18 +267,19 @@ static nsresult NSAPI handle_load(nsIDOMEventListener *iface, nsIDOMEvent *event
         IDocObjectService_FireDocumentComplete(doc_obj->doc_object_service,
                 &doc->basedoc.window->base.IHTMLWindow2_iface, 0);
 
-    if(!doc->nsdoc) {
-        ERR("NULL nsdoc\n");
-        return NS_ERROR_FAILURE;
-    }
-
+    if(doc->nsdoc) {
         nsIDOMHTMLDocument_GetBody(doc->nsdoc, &nsbody);
         if(nsbody) {
             fire_event(doc, EVENTID_LOAD, TRUE, (nsIDOMNode*)nsbody, event, (IDispatch*)&doc->window->base.IDispatchEx_iface);
             nsIDOMHTMLElement_Release(nsbody);
         }
+    }else {
+        ERR("NULL nsdoc\n");
+        nsres = NS_ERROR_FAILURE;
+    }
 
-    return NS_OK;
+    htmldoc_release(&doc->basedoc);
+    return nsres;
 }
 
 static nsresult NSAPI handle_htmlevent(nsIDOMEventListener *iface, nsIDOMEvent *event)