mshtml: Use per-inner window task_magic for binding.

dlls/mshtml/htmlwindow.c

@@ -235,6 +235,7 @@ static void release_inner_window(HTMLInnerWindow *This)
 
     TRACE("%p\n", This);
 
+    remove_target_tasks(This->task_magic);
     abort_window_bindings(This);
     release_script_hosts(This);
 
@@ -2622,6 +2623,8 @@ static HRESULT create_inner_window(HTMLOuterWindow *outer_window, HTMLInnerWindo
 
     init_dispex(&window->dispex, (IUnknown*)&window->base.IHTMLWindow2_iface, &HTMLWindow_dispex);
 
+    window->task_magic = get_task_target_magic();
+
     *ret = window;
     return S_OK;
 }

dlls/mshtml/mshtml_private.h

@@ -361,6 +361,8 @@ struct HTMLInnerWindow {
     DWORD global_prop_cnt;
     DWORD global_prop_size;
 
+    LONG task_magic;
+
     nsChannelBSC *bscallback;
     struct list bindings;
 };

dlls/mshtml/navigate.c

@@ -1325,7 +1325,7 @@ static HRESULT async_stop_request(nsChannelBSC *This)
     IBindStatusCallback_AddRef(&This->bsc.IBindStatusCallback_iface);
     task->bsc = This;
 
-    push_task(&task->header, stop_request_proc, stop_request_task_destr, This->window->doc_obj->basedoc.task_magic);
+    push_task(&task->header, stop_request_proc, stop_request_task_destr, This->bsc.window->task_magic);
     return S_OK;
 }
 
@@ -1679,7 +1679,7 @@ HRESULT async_start_doc_binding(HTMLOuterWindow *window, HTMLInnerWindow *pendin
     task->pending_window = pending_window;
     IHTMLWindow2_AddRef(&pending_window->base.IHTMLWindow2_iface);
 
-    push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, window->task_magic);
+    push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, pending_window->task_magic);
     return S_OK;
 }
 
@@ -1687,6 +1687,8 @@ void abort_window_bindings(HTMLInnerWindow *window)
 {
     BSCallback *iter;
 
+    remove_target_tasks(window->task_magic);
+
     while(!list_empty(&window->bindings)) {
         iter = LIST_ENTRY(window->bindings.next, BSCallback, entry);
 
@@ -1694,9 +1696,6 @@ void abort_window_bindings(HTMLInnerWindow *window)
 
         IBindStatusCallback_AddRef(&iter->IBindStatusCallback_iface);
 
-        if(iter->window && iter->window->doc)
-            remove_target_tasks(iter->window->doc->basedoc.task_magic);
-
         if(iter->binding)
             IBinding_Abort(iter->binding);
         else