From 23fc0dc8e854cbebc9e1b77eebf90974eb82739d Mon Sep 17 00:00:00 2001
From: Jacek Caban <jacek@codeweavers.com>
Date: Fri, 26 Sep 2014 15:11:28 +0200
Subject: [PATCH] mshtml: Don't share nsimg reference with nsnode.

---
 dlls/mshtml/htmlimg.c | 32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/dlls/mshtml/htmlimg.c b/dlls/mshtml/htmlimg.c
index 8c1d324747..57eaa7eb11 100644
--- a/dlls/mshtml/htmlimg.c
+++ b/dlls/mshtml/htmlimg.c
@@ -686,6 +686,26 @@ static HRESULT HTMLImgElement_get_readystate(HTMLDOMNode *iface, BSTR *p)
     return IHTMLImgElement_get_readyState(&This->IHTMLImgElement_iface, p);
 }
 
+static void HTMLImgElement_traverse(HTMLDOMNode *iface, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLImgElement *This = impl_from_HTMLDOMNode(iface);
+
+    if(This->nsimg)
+        note_cc_edge((nsISupports*)This->nsimg, "This->nsimg", cb);
+}
+
+static void HTMLImgElement_unlink(HTMLDOMNode *iface)
+{
+    HTMLImgElement *This = impl_from_HTMLDOMNode(iface);
+
+    if(This->nsimg) {
+        nsIDOMHTMLImageElement *nsimg = This->nsimg;
+
+        This->nsimg = NULL;
+        nsIDOMHTMLImageElement_Release(nsimg);
+    }
+}
+
 static const NodeImplVtbl HTMLImgElementImplVtbl = {
     HTMLImgElement_QI,
     HTMLElement_destructor,
@@ -698,7 +718,12 @@ static const NodeImplVtbl HTMLImgElementImplVtbl = {
     NULL,
     NULL,
     NULL,
-    HTMLImgElement_get_readystate
+    HTMLImgElement_get_readystate,
+    NULL,
+    NULL,
+    NULL,
+    HTMLImgElement_traverse,
+    HTMLImgElement_unlink
 };
 
 static const tid_t HTMLImgElement_iface_tids[] = {
@@ -728,10 +753,7 @@ HRESULT HTMLImgElement_Create(HTMLDocumentNode *doc, nsIDOMHTMLElement *nselem,
     HTMLElement_Init(&ret->element, doc, nselem, &HTMLImgElement_dispex);
 
     nsres = nsIDOMHTMLElement_QueryInterface(nselem, &IID_nsIDOMHTMLImageElement, (void**)&ret->nsimg);
-
-    /* Share nsimg reference with nsnode */
-    assert(nsres == NS_OK && (nsIDOMNode*)ret->nsimg == ret->element.node.nsnode);
-    nsIDOMNode_Release(ret->element.node.nsnode);
+    assert(nsres == NS_OK);
 
     *elem = &ret->element;
     return S_OK;