mshtml: Keep ref from the ImageElementFactory to the inner window.

dlls/mshtml/htmlimg.c

@@ -846,7 +846,7 @@ static HRESULT WINAPI HTMLImageElementFactory_create(IHTMLImageElementFactory *i
         VARIANT width, VARIANT height, IHTMLImgElement **img_elem)
 {
     HTMLImageElementFactory *This = impl_from_IHTMLImageElementFactory(iface);
-    HTMLDocumentNode *doc;
+    HTMLDocumentNode *doc = This->window->doc;
     IHTMLImgElement *img;
     HTMLElement *elem;
     nsIDOMElement *nselem;
@@ -856,13 +856,6 @@ static HRESULT WINAPI HTMLImageElementFactory_create(IHTMLImageElementFactory *i
     TRACE("(%p)->(%s %s %p)\n", This, debugstr_variant(&width),
             debugstr_variant(&height), img_elem);
 
-    if(!This->window || !This->window->doc) {
-        WARN("NULL doc\n");
-        return E_UNEXPECTED;
-    }
-
-    doc = This->window->doc;
-
     *img_elem = NULL;
 
     hres = create_nselem(doc, L"IMG", &nselem);
@@ -921,6 +914,25 @@ static void *HTMLImageElementFactory_query_interface(DispatchEx *dispex, REFIID
     return NULL;
 }
 
+static void HTMLImageElementFactory_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLImageElementFactory *This = impl_from_DispatchEx(dispex);
+
+    if(This->window)
+        note_cc_edge((nsISupports*)&This->window->base.IHTMLWindow2_iface, "window", cb);
+}
+
+static void HTMLImageElementFactory_unlink(DispatchEx *dispex)
+{
+    HTMLImageElementFactory *This = impl_from_DispatchEx(dispex);
+
+    if(This->window) {
+        HTMLInnerWindow *window = This->window;
+        This->window = NULL;
+        IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
+    }
+}
+
 static void HTMLImageElementFactory_destructor(DispatchEx *dispex)
 {
     HTMLImageElementFactory *This = impl_from_DispatchEx(dispex);
@@ -963,6 +975,8 @@ static const tid_t HTMLImageElementFactory_iface_tids[] = {
 static const dispex_static_data_vtbl_t HTMLImageElementFactory_dispex_vtbl = {
     .query_interface  = HTMLImageElementFactory_query_interface,
     .destructor       = HTMLImageElementFactory_destructor,
+    .traverse         = HTMLImageElementFactory_traverse,
+    .unlink           = HTMLImageElementFactory_unlink,
     .value            = HTMLImageElementFactory_value,
 };
 
@@ -983,6 +997,7 @@ HRESULT HTMLImageElementFactory_Create(HTMLInnerWindow *window, HTMLImageElement
 
     ret->IHTMLImageElementFactory_iface.lpVtbl = &HTMLImageElementFactoryVtbl;
     ret->window = window;
+    IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
 
     init_dispatch(&ret->dispex, &HTMLImageElementFactory_dispex, dispex_compat_mode(&window->event_target.dispex));
 

dlls/mshtml/htmlwindow.c

@@ -3977,7 +3977,6 @@ static void HTMLWindow_unlink(DispatchEx *dispex)
 
     if(This->image_factory) {
         HTMLImageElementFactory *image_factory = This->image_factory;
-        This->image_factory->window = NULL;
         This->image_factory = NULL;
         IHTMLImageElementFactory_Release(&image_factory->IHTMLImageElementFactory_iface);
     }

dlls/mshtml/tests/events.c

@@ -3236,13 +3236,18 @@ static void test_iframe_connections(IHTMLDocument2 *doc)
 
 static void test_window_refs(IHTMLDocument2 *doc)
 {
+    IHTMLImageElementFactory *image_factory;
     IHTMLWindow2 *self, *parent, *child;
+    IHTMLImgElement *img_elem;
     IHTMLFrameBase2 *iframe;
     IHTMLDocument6 *doc6;
     IHTMLElement2 *elem;
+    VARIANT vempty;
     HRESULT hres;
     BSTR bstr;
 
+    V_VT(&vempty) = VT_EMPTY;
+
     hres = IHTMLDocument2_QueryInterface(doc, &IID_IHTMLDocument6, (void**)&doc6);
     ok(hres == S_OK, "Could not get IHTMLDocument6 iface: %08lx\n", hres);
     bstr = SysAllocString(L"ifr");
@@ -3258,6 +3263,9 @@ static void test_window_refs(IHTMLDocument2 *doc)
     ok(hres == S_OK, "get_contentWindow failed: %08lx\n", hres);
     IHTMLFrameBase2_Release(iframe);
 
+    hres = IHTMLWindow2_get_Image(window, &image_factory);
+    ok(hres == S_OK, "get_Image failed: %08lx\n", hres);
+
     hres = IHTMLWindow2_get_self(window, &self);
     ok(hres == S_OK, "get_self failed: %08lx\n", hres);
     hres = IHTMLWindow2_get_parent(child, &parent);
@@ -3271,9 +3279,14 @@ static void test_window_refs(IHTMLDocument2 *doc)
     hres = IHTMLWindow2_get_parent(child, &parent);
     ok(hres == S_OK, "get_parent failed: %08lx\n", hres);
     ok(parent == child, "parent != child\n");
-
     IHTMLWindow2_Release(parent);
     IHTMLWindow2_Release(child);
+
+    hres = IHTMLImageElementFactory_create(image_factory, vempty, vempty, &img_elem);
+    ok(hres == S_OK, "create failed: %08lx\n", hres);
+    ok(img_elem != NULL, "img_elem == NULL\n");
+    IHTMLImageElementFactory_Release(image_factory);
+    IHTMLImgElement_Release(img_elem);
 }
 
 static void test_doc_obj(IHTMLDocument2 *doc)