mshtml: Don't access BSCallback directly in nsembed.c.

dlls/mshtml/mshtml_private.h

@@ -435,6 +435,7 @@ void set_document_bscallback(HTMLDocument*,BSCallback*);
 void set_current_mon(HTMLDocument*,IMoniker*);
 
 void channelbsc_set_channel(BSCallback*,nsChannel*,nsIStreamListener*,nsISupports*);
+IMoniker *get_channelbsc_mon(BSCallback*);
 
 IHTMLSelectionObject *HTMLSelectionObject_Create(HTMLDocument*,nsISelection*);
 IHTMLTxtRange *HTMLTxtRange_Create(HTMLDocument*,nsIDOMRange*);

dlls/mshtml/navigate.c

@@ -866,6 +866,13 @@ HRESULT start_binding(HTMLDocument *doc, BSCallback *bscallback, IBindCtx *bctx)
     return S_OK;
 }
 
+IMoniker *get_channelbsc_mon(BSCallback *This)
+{
+    if(This->mon)
+        IMoniker_AddRef(This->mon);
+    return This->mon;
+}
+
 void set_document_bscallback(HTMLDocument *doc, BSCallback *callback)
 {
     BSCallback *iter;

dlls/mshtml/nsembed.c

@@ -1138,16 +1138,22 @@ static nsresult NSAPI nsURIContentListener_OnStartURIOpen(nsIURIContentListener
     nsIWineURI_SetNSContainer(wine_uri, This);
     nsIWineURI_SetIsDocumentURI(wine_uri, TRUE);
 
-    if(This->bscallback && This->bscallback->mon) {
-        LPWSTR wine_url;
-        HRESULT hres;
-
-        hres = IMoniker_GetDisplayName(This->bscallback->mon, NULL, 0, &wine_url);
-        if(SUCCEEDED(hres)) {
-            nsIWineURI_SetWineURL(wine_uri, wine_url);
-            CoTaskMemFree(wine_url);
-        }else {
-            WARN("GetDisplayName failed: %08x\n", hres);
+    if(This->bscallback) {
+        IMoniker *mon = get_channelbsc_mon(This->bscallback);
+
+        if(mon) {
+            LPWSTR wine_url;
+            HRESULT hres;
+
+            hres = IMoniker_GetDisplayName(mon, NULL, 0, &wine_url);
+            if(SUCCEEDED(hres)) {
+                nsIWineURI_SetWineURL(wine_uri, wine_url);
+                CoTaskMemFree(wine_url);
+            }else {
+                WARN("GetDisplayName failed: %08x\n", hres);
+            }
+
+            IMoniker_Release(mon);
         }
     }