mshtml: Store HTMLDocument reference in HTMLSelectionObject.

dlls/mshtml/htmldoc.c

@@ -172,6 +172,7 @@ static ULONG WINAPI HTMLDocument_Release(IHTMLDocument2 *iface)
         if(This->window)
             IHTMLWindow2_Release(HTMLWINDOW2(This->window));
 
+        detach_selection(This);
         release_nodes(This);
 
         ConnectionPointContainer_Destroy(&This->cp_container);
@@ -376,7 +377,7 @@ static HRESULT WINAPI HTMLDocument_get_selection(IHTMLDocument2 *iface, IHTMLSel
         }
     }
 
-    *p = HTMLSelectionObject_Create(nsselection);
+    *p = HTMLSelectionObject_Create(This, nsselection);
     return S_OK;
 }
 
@@ -1128,6 +1129,8 @@ HRESULT HTMLDocument_Create(IUnknown *pUnkOuter, REFIID riid, void** ppvObject)
     ret->readystate = READYSTATE_UNINITIALIZED;
     ret->window = NULL;
 
+    list_init(&ret->selection_list);
+
     hres = IHTMLDocument_QueryInterface(HTMLDOC(ret), riid, ppvObject);
     if(FAILED(hres)) {
         mshtml_free(ret);

dlls/mshtml/mshtml_private.h

@@ -150,6 +150,8 @@ struct HTMLDocument {
     ConnectionPoint cp_htmldocevents2;
     ConnectionPoint cp_propnotif;
 
+    struct list selection_list;
+
     HTMLDOMNode *nodes;
 };
 
@@ -401,11 +403,13 @@ HRESULT load_stream(BSCallback*,IStream*);
 void set_document_bscallback(HTMLDocument*,BSCallback*);
 void set_current_mon(HTMLDocument*,IMoniker*);
 
-IHTMLSelectionObject *HTMLSelectionObject_Create(nsISelection*);
+IHTMLSelectionObject *HTMLSelectionObject_Create(HTMLDocument*,nsISelection*);
 IHTMLTxtRange *HTMLTxtRange_Create(nsIDOMRange*);
 IHTMLStyle *HTMLStyle_Create(nsIDOMCSSStyleDeclaration*);
 IHTMLStyleSheet *HTMLStyleSheet_Create(void);
 
+void detach_selection(HTMLDocument*);
+
 void HTMLElement_Create(HTMLDOMNode*);
 void HTMLBodyElement_Create(HTMLElement*);
 void HTMLInputElement_Create(HTMLElement*);

dlls/mshtml/selection.c

@@ -42,6 +42,9 @@ typedef struct {
     LONG ref;
 
     nsISelection *nsselection;
+    HTMLDocument *doc;
+
+    struct list entry;
 } HTMLSelectionObject;
 
 #define HTMLSELOBJ(x)  ((IHTMLSelectionObject*) &(x)->lpHTMLSelectionObjectVtbl)
@@ -95,6 +98,8 @@ static ULONG WINAPI HTMLSelectionObject_Release(IHTMLSelectionObject *iface)
     if(!ref) {
         if(This->nsselection)
             nsISelection_Release(This->nsselection);
+        if(This->doc)
+            list_remove(&This->entry);
         mshtml_free(This);
     }
 
@@ -208,7 +213,7 @@ static const IHTMLSelectionObjectVtbl HTMLSelectionObjectVtbl = {
     HTMLSelectionObject_get_type
 };
 
-IHTMLSelectionObject *HTMLSelectionObject_Create(nsISelection *nsselection)
+IHTMLSelectionObject *HTMLSelectionObject_Create(HTMLDocument *doc, nsISelection *nsselection)
 {
     HTMLSelectionObject *ret = mshtml_alloc(sizeof(HTMLSelectionObject));
 
@@ -216,5 +221,17 @@ IHTMLSelectionObject *HTMLSelectionObject_Create(nsISelection *nsselection)
     ret->ref = 1;
     ret->nsselection = nsselection; /* We shouldn't call AddRef here */
 
+    ret->doc = doc;
+    list_add_head(&doc->selection_list, &ret->entry);
+
     return HTMLSELOBJ(ret);
 }
+
+void detach_selection(HTMLDocument *This)
+{
+    HTMLSelectionObject *iter;
+
+    LIST_FOR_EACH_ENTRY(iter, &This->selection_list, HTMLSelectionObject, entry) {
+        iter->doc = NULL;
+    }
+}