From: Jacek Caban <jacek@codeweavers.com>
Subject: mshtml: Fixed binding event scripts to window objects.
Message-Id: <55311A2C.5050805@codeweavers.com>
Date: Fri, 17 Apr 2015 16:35:24 +0200

---
 dlls/mshtml/htmlevent.c |  7 ++++---
 dlls/mshtml/htmlevent.h |  2 +-
 dlls/mshtml/script.c    | 32 ++++++++++++++++++--------------
 3 files changed, 23 insertions(+), 18 deletions(-)

diff --git a/dlls/mshtml/htmlevent.c b/dlls/mshtml/htmlevent.c
index a14ce72..30ce6b1 100644
--- a/dlls/mshtml/htmlevent.c
+++ b/dlls/mshtml/htmlevent.c
@@ -1529,11 +1529,12 @@ HRESULT detach_event(event_target_t *event_target, HTMLDocument *doc, BSTR name,
     return S_OK;
 }
 
-void bind_node_event(HTMLDocumentNode *doc, event_target_t **event_target, HTMLDOMNode *node, const WCHAR *event, IDispatch *disp)
+void bind_target_event(HTMLDocumentNode *doc, event_target_t **event_target, DispatchEx *dispex,
+        const WCHAR *event, IDispatch *disp)
 {
     eventid_t eid;
 
-    TRACE("(%p %p %p %s %p)\n", doc, event_target, node, debugstr_w(event), disp);
+    TRACE("(%p %p %p %s %p)\n", doc, event_target, dispex, debugstr_w(event), disp);
 
     eid = attr_to_eid(event);
     if(eid == EVENTID_LAST) {
@@ -1541,7 +1542,7 @@ void bind_node_event(HTMLDocumentNode *doc, event_target_t **event_target, HTMLD
         return;
     }
 
-    set_event_handler_disp(&node->dispex, event_target, doc, eid, disp);
+    set_event_handler_disp(dispex, event_target, doc, eid, disp);
 }
 
 void update_cp_events(HTMLInnerWindow *window, event_target_t **event_target_ptr, cp_static_data_t *cp)
diff --git a/dlls/mshtml/htmlevent.h b/dlls/mshtml/htmlevent.h
index 0517834..86d5816 100644
--- a/dlls/mshtml/htmlevent.h
+++ b/dlls/mshtml/htmlevent.h
@@ -64,7 +64,7 @@ void update_cp_events(HTMLInnerWindow*,event_target_t**,cp_static_data_t*) DECLS
 HRESULT doc_init_events(HTMLDocumentNode*) DECLSPEC_HIDDEN;
 void detach_events(HTMLDocumentNode *doc) DECLSPEC_HIDDEN;
 HRESULT create_event_obj(IHTMLEventObj**) DECLSPEC_HIDDEN;
-void bind_node_event(HTMLDocumentNode*,event_target_t**,HTMLDOMNode*,const WCHAR*,IDispatch*) DECLSPEC_HIDDEN;
+void bind_target_event(HTMLDocumentNode*,event_target_t**,DispatchEx*,const WCHAR*,IDispatch*) DECLSPEC_HIDDEN;
 
 void init_nsevents(HTMLDocumentNode*) DECLSPEC_HIDDEN;
 void release_nsevents(HTMLDocumentNode*) DECLSPEC_HIDDEN;
diff --git a/dlls/mshtml/script.c b/dlls/mshtml/script.c
index 4590854..e3c9498 100644
--- a/dlls/mshtml/script.c
+++ b/dlls/mshtml/script.c
@@ -1314,9 +1314,9 @@ IDispatch *get_script_disp(ScriptHost *script_host)
     return disp;
 }
 
-static event_target_t **find_event_target(HTMLDocumentNode *doc, HTMLScriptElement *script_elem, HTMLDOMNode **ret_target_node)
+static event_target_t **find_event_target(HTMLDocumentNode *doc, HTMLScriptElement *script_elem, DispatchEx **ret_target_dispex)
 {
-    HTMLDOMNode *target_node = NULL;
+    DispatchEx *target_dispex = NULL;
     event_target_t **target = NULL;
     const PRUnichar *target_id;
     nsAString target_id_str;
@@ -1336,22 +1336,26 @@ static event_target_t **find_event_target(HTMLDocumentNode *doc, HTMLScriptEleme
         FIXME("Empty for attribute\n");
     }else if(!strcmpW(target_id, documentW)) {
         target = &doc->node.event_target;
-        target_node = &doc->node;
-        IHTMLDOMNode_AddRef(&target_node->IHTMLDOMNode_iface);
+        target_dispex = &doc->node.dispex;
+        htmldoc_addref(&doc->basedoc);
     }else if(!strcmpW(target_id, windowW)) {
-        target = &doc->body_event_target;
+        if(doc->window) {
+            target_dispex = &doc->window->dispex;
+            IDispatchEx_AddRef(&target_dispex->IDispatchEx_iface);
+            target = &doc->body_event_target;
+        }
     }else {
         HTMLElement *target_elem;
 
         hres = get_doc_elem_by_id(doc, target_id, &target_elem);
         if(SUCCEEDED(hres) && target_elem) {
-            target_node = &target_elem->node;
+            target_dispex = &target_elem->node.dispex;
             target = &target_elem->node.event_target;
         }
     }
     nsAString_Finish(&target_id_str);
 
-    *ret_target_node = target_node;
+    *ret_target_dispex = target_dispex;
     return target;
 }
 
@@ -1449,7 +1453,7 @@ void bind_event_scripts(HTMLDocumentNode *doc)
     HTMLScriptElement *script_elem;
     event_target_t **event_target;
     nsIDOMNodeList *node_list;
-    HTMLDOMNode *target_node;
+    DispatchEx *target_dispex;
     nsIDOMNode *script_node;
     nsAString selector_str;
     IDispatch *event_disp;
@@ -1496,10 +1500,10 @@ void bind_event_scripts(HTMLDocumentNode *doc)
 
         event_disp = parse_event_elem(doc, script_elem, &event);
         if(event_disp) {
-            event_target = find_event_target(doc, script_elem, &target_node);
+            event_target = find_event_target(doc, script_elem, &target_dispex);
             if(event_target) {
-                if(target_node)
-                    hres = IHTMLDOMNode_QueryInterface(&target_node->IHTMLDOMNode_iface, &IID_HTMLPluginContainer,
+                if(target_dispex)
+                    hres = IDispatchEx_QueryInterface(&target_dispex->IDispatchEx_iface, &IID_HTMLPluginContainer,
                             (void**)&plugin_container);
                 else
                     hres = E_NOINTERFACE;
@@ -1507,10 +1511,10 @@ void bind_event_scripts(HTMLDocumentNode *doc)
                 if(SUCCEEDED(hres))
                     bind_activex_event(doc, plugin_container, event, event_disp);
                 else
-                    bind_node_event(doc, event_target, target_node, event, event_disp);
+                    bind_target_event(doc, event_target, target_dispex, event, event_disp);
 
-                if(target_node) {
-                    IHTMLDOMNode_Release(&target_node->IHTMLDOMNode_iface);
+                if(target_dispex) {
+                    IDispatchEx_Release(&target_dispex->IDispatchEx_iface);
                     if(plugin_container)
                         node_release(&plugin_container->element.node);
                 }