Jacek Caban : mshtml: Don't call CP event sinks on detached documents.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 8086af47b5f803bd2e9dc2cbdf9569a06aeaf630
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=8086af47b5f803bd2e9dc2cbdf9569a06aeaf630

Author: Jacek Caban <jacek at codeweavers.com>
Date:   Mon Nov  5 19:04:18 2012 +0100

mshtml: Don't call CP event sinks on detached documents.

---

 dlls/mshtml/htmlevent.c |   12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/dlls/mshtml/htmlevent.c b/dlls/mshtml/htmlevent.c
index 068114a..cb8a1cf 100644
--- a/dlls/mshtml/htmlevent.c
+++ b/dlls/mshtml/htmlevent.c
@@ -996,7 +996,12 @@ static void call_event_handlers(HTMLDocumentNode *doc, HTMLEventObj *event_obj,
         }
     }
 
-    if(cp_container) {
+    /*
+     * NOTE: CP events may require doc_obj reference, which we don't own. We make sure that
+     * it's safe to call event handler by checking nsevent_listener, which is NULL for
+     * detached documents.
+     */
+    if(cp_container && doc->nsevent_listener) {
         ConnectionPoint *cp;
 
         if(cp_container->forward_container)
@@ -1004,7 +1009,7 @@ static void call_event_handlers(HTMLDocumentNode *doc, HTMLEventObj *event_obj,
 
         for(cp = cp_container->cp_list; cp; cp = cp->next) {
             if(cp->sinks_size && is_cp_event(cp->data, event_info[eid].dispid)) {
-                for(i=0; i < cp->sinks_size; i++) {
+                for(i=0; doc->nsevent_listener && i < cp->sinks_size; i++) {
                     if(!cp->sinks[i].disp)
                         continue;
 
@@ -1028,6 +1033,9 @@ static void call_event_handlers(HTMLDocumentNode *doc, HTMLEventObj *event_obj,
                         WARN("cp %s [%d] <<< %08x\n", debugstr_w(event_info[eid].name), i, hres);
                     }
                 }
+
+                if(!doc->nsevent_listener)
+                    break;
             }
         }
     }