mshtml: Keep ref from the OmHistory to the inner window.

dlls/mshtml/htmlwindow.c

@@ -3994,7 +3994,6 @@ static void HTMLWindow_unlink(DispatchEx *dispex)
     unlink_ref(&This->screen);
     if(This->history) {
         OmHistory *history = This->history;
-        This->history->window = NULL;
         This->history = NULL;
         IOmHistory_Release(&history->IOmHistory_iface);
     }

dlls/mshtml/omnavigator.c

@@ -644,7 +644,7 @@ static HRESULT WINAPI OmHistory_get_length(IOmHistory *iface, short *p)
 
     TRACE("(%p)->(%p)\n", This, p);
 
-    if(This->window && This->window->base.outer_window)
+    if(This->window->base.outer_window)
         browser = This->window->base.outer_window->browser;
 
     *p = browser && browser->doc->travel_log
@@ -703,6 +703,25 @@ static void *OmHistory_query_interface(DispatchEx *dispex, REFIID riid)
     return NULL;
 }
 
+static void OmHistory_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    OmHistory *This = OmHistory_from_DispatchEx(dispex);
+
+    if(This->window)
+        note_cc_edge((nsISupports*)&This->window->base.IHTMLWindow2_iface, "window", cb);
+}
+
+static void OmHistory_unlink(DispatchEx *dispex)
+{
+    OmHistory *This = OmHistory_from_DispatchEx(dispex);
+
+    if(This->window) {
+        HTMLInnerWindow *window = This->window;
+        This->window = NULL;
+        IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
+    }
+}
+
 static void OmHistory_destructor(DispatchEx *dispex)
 {
     OmHistory *This = OmHistory_from_DispatchEx(dispex);
@@ -712,6 +731,8 @@ static void OmHistory_destructor(DispatchEx *dispex)
 static const dispex_static_data_vtbl_t OmHistory_dispex_vtbl = {
     .query_interface  = OmHistory_query_interface,
     .destructor       = OmHistory_destructor,
+    .traverse         = OmHistory_traverse,
+    .unlink           = OmHistory_unlink,
 };
 
 static const tid_t OmHistory_iface_tids[] = {
@@ -738,6 +759,7 @@ HRESULT create_history(HTMLInnerWindow *window, OmHistory **ret)
     history->IOmHistory_iface.lpVtbl = &OmHistoryVtbl;
 
     history->window = window;
+    IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
 
     *ret = history;
     return S_OK;

dlls/mshtml/tests/events.c

@@ -3247,8 +3247,10 @@ static void test_window_refs(IHTMLDocument2 *doc)
     IHTMLWindow5 *window5;
     IHTMLDocument6 *doc6;
     IHTMLElement2 *elem;
+    IOmHistory *history;
     VARIANT vempty, var;
     HRESULT hres;
+    short length;
     BSTR bstr;
 
     V_VT(&vempty) = VT_EMPTY;
@@ -3282,6 +3284,8 @@ static void test_window_refs(IHTMLDocument2 *doc)
     ok(hres == S_OK, "get_Image failed: %08lx\n", hres);
     hres = IHTMLWindow2_get_Option(window, &option_factory);
     ok(hres == S_OK, "get_Option failed: %08lx\n", hres);
+    hres = IHTMLWindow2_get_history(window, &history);
+    ok(hres == S_OK, "get_history failed: %08lx\n", hres);
 
     hres = IHTMLWindow2_get_self(window, &self);
     ok(hres == S_OK, "get_self failed: %08lx\n", hres);
@@ -3316,6 +3320,12 @@ static void test_window_refs(IHTMLDocument2 *doc)
     ok(option_elem != NULL, "option_elem == NULL\n");
     IHTMLOptionElementFactory_Release(option_factory);
     IHTMLOptionElement_Release(option_elem);
+
+    hres = IOmHistory_get_length(history, &length);
+    ok(hres == S_OK, "get_length failed: %08lx\n", hres);
+    todo_wine
+    ok(length == 42, "length = %d\n", length);
+    IOmHistory_Release(history);
 }
 
 static void test_doc_obj(IHTMLDocument2 *doc)
@@ -4396,7 +4406,7 @@ static HRESULT WINAPI TravelLog_Clone(ITravelLog *iface, ITravelLog **pptl)
 
 static DWORD WINAPI TravelLog_CountEntries(ITravelLog *iface, IUnknown *punk)
 {
-    return 0;
+    return 42;
 }
 
 static HRESULT WINAPI TravelLog_Revert(ITravelLog *iface)