mshtml: Fixed unsafe cast in CreateChromeWindow2 implementation.

dlls/mshtml/mshtml_private.h

@@ -705,6 +705,7 @@ void ConnectionPointContainer_Destroy(ConnectionPointContainer*);
 
 NSContainer *NSContainer_Create(HTMLDocumentObj*,NSContainer*);
 void NSContainer_Release(NSContainer*);
+nsresult create_chrome_window(nsIWebBrowserChrome*,nsIWebBrowserChrome**);
 
 void init_mutation(HTMLDocumentNode*);
 void release_mutation(HTMLDocumentNode*);

dlls/mshtml/nsembed.c

@@ -1150,8 +1150,6 @@ static nsresult NSAPI nsWebBrowserChrome_ExitModalEventLoop(nsIWebBrowserChrome
     return NS_ERROR_NOT_IMPLEMENTED;
 }
 
-#undef NSWBCHROME_THIS
-
 static const nsIWebBrowserChromeVtbl nsWebBrowserChromeVtbl = {
     nsWebBrowserChrome_QueryInterface,
     nsWebBrowserChrome_AddRef,
@@ -1711,6 +1709,17 @@ static const nsISupportsWeakReferenceVtbl nsSupportsWeakReferenceVtbl = {
     nsSupportsWeakReference_GetWeakReference
 };
 
+nsresult create_chrome_window(nsIWebBrowserChrome *parent, nsIWebBrowserChrome **ret)
+{
+    NSContainer *new_container;
+
+    if(parent->lpVtbl != &nsWebBrowserChromeVtbl)
+        return NS_ERROR_UNEXPECTED;
+
+    new_container = NSContainer_Create(NULL, NSWBCHROME_THIS(parent));
+    *ret = NSWBCHROME(new_container);
+    return NS_OK;
+}
 
 NSContainer *NSContainer_Create(HTMLDocumentObj *doc, NSContainer *parent)
 {

dlls/mshtml/nsservice.c

@@ -99,8 +99,7 @@ static nsresult NSAPI nsWindowCreator_CreateChromeWindow2(nsIWindowCreator2 *ifa
     if(cancel)
         *cancel = FALSE;
 
-    *_retval = NSWBCHROME(NSContainer_Create(NULL, (NSContainer*)parent));
-    return NS_OK;
+    return create_chrome_window(parent, _retval);
 }
 
 static const nsIWindowCreator2Vtbl nsWindowCreatorVtbl = {