mshtml: Grab refs to windows upfront before sending pagehide events.

dlls/mshtml/view.c

@@ -414,14 +414,48 @@ HRESULT call_set_active_object(IOleInPlaceUIWindow *window, IOleInPlaceActiveObj
     return IOleInPlaceUIWindow_SetActiveObject(window, act_obj, act_obj ? html_documentW : NULL);
 }
 
-static void send_unload_events_impl(HTMLInnerWindow *window)
+static unsigned get_window_list_num(HTMLInnerWindow *window)
 {
     HTMLOuterWindow *child;
+    unsigned ret = 1;
+
+    LIST_FOR_EACH_ENTRY(child, &window->children, HTMLOuterWindow, sibling_entry)
+        ret += get_window_list_num(child->base.inner_window);
+    return ret;
+}
+
+static HTMLInnerWindow **get_window_list(HTMLInnerWindow *window, HTMLInnerWindow **output)
+{
+    HTMLOuterWindow *child;
+
+    *output++ = window;
+    IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
+
+    LIST_FOR_EACH_ENTRY(child, &window->children, HTMLOuterWindow, sibling_entry)
+        output = get_window_list(child->base.inner_window, output);
+    return output;
+}
+
+static void send_unload_events(HTMLDocumentObj *doc)
+{
+    HTMLInnerWindow **windows, *window;
     DOMEvent *event;
+    unsigned i, num;
     HRESULT hres;
 
-    if(!window)
+    if(!doc->window || !doc->doc_node->content_ready)
+        return;
+    window = doc->window->base.inner_window;
+
+    /* Grab list of all windows ahead, and keep refs,
+       since it can be detached from under our feet. */
+    num = get_window_list_num(window);
+    if(!(windows = malloc(num * sizeof(*windows))))
         return;
+    get_window_list(window, windows);
+
+    for(i = 0; i < num; i++) {
+        window = windows[i];
 
         if(window->doc && !window->doc->unload_sent) {
             window->doc->unload_sent = TRUE;
@@ -443,16 +477,10 @@ static void send_unload_events_impl(HTMLInnerWindow *window)
             }
         }
 
-    LIST_FOR_EACH_ENTRY(child, &window->children, HTMLOuterWindow, sibling_entry)
-        send_unload_events_impl(child->base.inner_window);
-}
-
-static void send_unload_events(HTMLDocumentObj *doc)
-{
-    if(!doc->window || !doc->doc_node->content_ready)
-        return;
+        IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
+    }
 
-    send_unload_events_impl(doc->window->base.inner_window);
+    free(windows);
 }
 
 /**********************************************************