From c323d9c3e07ec4ebaa0197f4fdfa6b71af56664a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gabriel=20Iv=C4=83ncescu?= <gabrielopcode@gmail.com>
Date: Wed, 1 Nov 2023 17:00:40 +0200
Subject: [PATCH] mshtml: Keep ref from LocalStorage and SessionStorage to the
 inner window.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>
---
 dlls/mshtml/htmlstorage.c    | 30 ++++++++++++++++++++++--------
 dlls/mshtml/htmlwindow.c     |  2 --
 dlls/mshtml/mshtml_private.h |  2 --
 3 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/dlls/mshtml/htmlstorage.c b/dlls/mshtml/htmlstorage.c
index d3bbb30580e..efd4b2d88ae 100644
--- a/dlls/mshtml/htmlstorage.c
+++ b/dlls/mshtml/htmlstorage.c
@@ -322,8 +322,6 @@ static HRESULT send_storage_event(HTMLStorage *storage, BSTR key, BSTR old_value
     HRESULT hres = S_OK;
 
     ctx.url = NULL;
-    if(!window)
-        goto done;
     if(window->base.outer_window->uri_nofrag) {
         hres = IUri_GetDisplayUri(window->base.outer_window->uri_nofrag, &ctx.url);
         if(hres != S_OK)
@@ -1041,6 +1039,25 @@ static void *HTMLStorage_query_interface(DispatchEx *dispex, REFIID riid)
     return NULL;
 }
 
+static void HTMLStorage_traverse(DispatchEx *dispex, nsCycleCollectionTraversalCallback *cb)
+{
+    HTMLStorage *This = impl_from_DispatchEx(dispex);
+
+    if(This->window)
+        note_cc_edge((nsISupports*)&This->window->base.IHTMLWindow2_iface, "window", cb);
+}
+
+static void HTMLStorage_unlink(DispatchEx *dispex)
+{
+    HTMLStorage *This = impl_from_DispatchEx(dispex);
+
+    if(This->window) {
+        HTMLInnerWindow *window = This->window;
+        This->window = NULL;
+        IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
+    }
+}
+
 static void HTMLStorage_destructor(DispatchEx *dispex)
 {
     HTMLStorage *This = impl_from_DispatchEx(dispex);
@@ -1298,6 +1315,8 @@ static HRESULT HTMLStorage_next_dispid(DispatchEx *dispex, DISPID id, DISPID *pi
 static const dispex_static_data_vtbl_t HTMLStorage_dispex_vtbl = {
     .query_interface  = HTMLStorage_query_interface,
     .destructor       = HTMLStorage_destructor,
+    .traverse         = HTMLStorage_traverse,
+    .unlink           = HTMLStorage_unlink,
     .get_dispid       = HTMLStorage_get_dispid,
     .get_name         = HTMLStorage_get_name,
     .invoke           = HTMLStorage_invoke,
@@ -1464,15 +1483,10 @@ HRESULT create_html_storage(HTMLInnerWindow *window, BOOL local, IHTMLStorage **
 
     storage->IHTMLStorage_iface.lpVtbl = &HTMLStorageVtbl;
     storage->window = window;
+    IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
 
     init_dispatch(&storage->dispex, &HTMLStorage_dispex, dispex_compat_mode(&window->event_target.dispex));
 
     *p = &storage->IHTMLStorage_iface;
     return S_OK;
 }
-
-void detach_html_storage(IHTMLStorage *iface)
-{
-    HTMLStorage *storage = impl_from_IHTMLStorage(iface);
-    storage->window = NULL;
-}
diff --git a/dlls/mshtml/htmlwindow.c b/dlls/mshtml/htmlwindow.c
index 36aede7244e..dc1e42020fd 100644
--- a/dlls/mshtml/htmlwindow.c
+++ b/dlls/mshtml/htmlwindow.c
@@ -4001,13 +4001,11 @@ static void HTMLWindow_unlink(DispatchEx *dispex)
     unlink_ref(&This->navigator);
     if(This->session_storage) {
         IHTMLStorage *session_storage = This->session_storage;
-        detach_html_storage(session_storage);
         This->session_storage = NULL;
         IHTMLStorage_Release(session_storage);
     }
     if(This->local_storage) {
         IHTMLStorage *local_storage = This->local_storage;
-        detach_html_storage(local_storage);
         This->local_storage = NULL;
         IHTMLStorage_Release(local_storage);
     }
diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h
index 7515fbfd2cd..504504dd1d4 100644
--- a/dlls/mshtml/mshtml_private.h
+++ b/dlls/mshtml/mshtml_private.h
@@ -998,9 +998,7 @@ HRESULT create_history(HTMLInnerWindow*,OmHistory**);
 HRESULT create_namespace_collection(compat_mode_t,IHTMLNamespaceCollection**);
 HRESULT create_dom_implementation(HTMLDocumentNode*,IHTMLDOMImplementation**);
 void detach_dom_implementation(IHTMLDOMImplementation*);
-
 HRESULT create_html_storage(HTMLInnerWindow*,BOOL,IHTMLStorage**);
-void detach_html_storage(IHTMLStorage*);
 
 void HTMLDocument_View_Init(HTMLDocumentObj*);
 void HTMLDocumentObj_Persist_Init(HTMLDocumentObj*);