dlls/mshtml/dispex.c

   1 /*
   2  * Copyright 2008-2009 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include <stdarg.h>
  20 #include <assert.h>
  21
  22 #define COBJMACROS
  23 #define NONAMELESSUNION
  24
  25 #include "windef.h"
  26 #include "winbase.h"
  27 #include "winuser.h"
  28 #include "ole2.h"
  29
  30 #include "wine/debug.h"
  31
  32 #include "mshtml_private.h"
  33
  34 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  35
  36 #define MAX_ARGS 16
  37
  38 static CRITICAL_SECTION cs_dispex_static_data;
  39 static CRITICAL_SECTION_DEBUG cs_dispex_static_data_dbg =
  40 {
  41     0, 0, &cs_dispex_static_data,
  42     { &cs_dispex_static_data_dbg.ProcessLocksList, &cs_dispex_static_data_dbg.ProcessLocksList },
  43       0, 0, { (DWORD_PTR)(__FILE__ ": dispex_static_data") }
  44 };
  45 static CRITICAL_SECTION cs_dispex_static_data = { &cs_dispex_static_data_dbg, -1, 0, 0, 0, 0 };
  46
  47
  48 static const WCHAR objectW[] = {'[','o','b','j','e','c','t',']',0};
  49
  50 typedef struct {
  51     DISPID id;
  52     BSTR name;
  53     tid_t tid;
  54     SHORT call_vtbl_off;
  55     SHORT put_vtbl_off;
  56     SHORT get_vtbl_off;
  57     SHORT func_disp_idx;
  58     USHORT argc;
  59     VARTYPE prop_vt;
  60     VARTYPE *arg_types;
  61 } func_info_t;
  62
  63 struct dispex_data_t {
  64     DWORD func_cnt;
  65     func_info_t *funcs;
  66     func_info_t **name_table;
  67     DWORD func_disp_cnt;
  68
  69     struct list entry;
  70 };
  71
  72 typedef struct {
  73     VARIANT var;
  74     LPWSTR name;
  75     DWORD flags;
  76 } dynamic_prop_t;
  77
  78 #define DYNPROP_DELETED    0x01
  79
  80 typedef struct {
  81     DispatchEx dispex;
  82     IUnknown IUnknown_iface;
  83     LONG ref;
  84     DispatchEx *obj;
  85     func_info_t *info;
  86 } func_disp_t;
  87
  88 typedef struct {
  89     func_disp_t *func_obj;
  90     VARIANT val;
  91 } func_obj_entry_t;
  92
  93 struct dispex_dynamic_data_t {
  94     DWORD buf_size;
  95     DWORD prop_cnt;
  96     dynamic_prop_t *props;
  97     func_obj_entry_t *func_disps;
  98 };
  99
 100 #define DISPID_DYNPROP_0    0x50000000
 101 #define DISPID_DYNPROP_MAX  0x5fffffff
 102
 103 #define FDEX_VERSION_MASK 0xf0000000
 104
 105 static ITypeLib *typelib;
 106 static ITypeInfo *typeinfos[LAST_tid];
 107 static struct list dispex_data_list = LIST_INIT(dispex_data_list);
 108
 109 static REFIID tid_ids[] = {
 110 #define XIID(iface) &IID_ ## iface,
 111 #define XDIID(iface) &DIID_ ## iface,
 112 TID_LIST
 113 #undef XIID
 114 #undef XDIID
 115 };
 116
 117 static HRESULT load_typelib(void)
 118 {
 119     HRESULT hres;
 120     ITypeLib *tl;
 121
 122     hres = LoadRegTypeLib(&LIBID_MSHTML, 4, 0, LOCALE_SYSTEM_DEFAULT, &tl);
 123     if(FAILED(hres)) {
 124         ERR("LoadRegTypeLib failed: %08x\n", hres);
 125         return hres;
 126     }
 127
 128     if(InterlockedCompareExchangePointer((void**)&typelib, tl, NULL))
 129         ITypeLib_Release(tl);
 130     return hres;
 131 }
 132
 133 static HRESULT get_typeinfo(tid_t tid, ITypeInfo **typeinfo)
 134 {
 135     HRESULT hres;
 136
 137     if (!typelib)
 138         hres = load_typelib();
 139     if (!typelib)
 140         return hres;
 141
 142     if(!typeinfos[tid]) {
 143         ITypeInfo *ti;
 144
 145         hres = ITypeLib_GetTypeInfoOfGuid(typelib, tid_ids[tid], &ti);
 146         if(FAILED(hres)) {
 147             ERR("GetTypeInfoOfGuid(%s) failed: %08x\n", debugstr_mshtml_guid(tid_ids[tid]), hres);
 148             return hres;
 149         }
 150
 151         if(InterlockedCompareExchangePointer((void**)(typeinfos+tid), ti, NULL))
 152             ITypeInfo_Release(ti);
 153     }
 154
 155     *typeinfo = typeinfos[tid];
 156     return S_OK;
 157 }
 158
 159 void release_typelib(void)
 160 {
 161     dispex_data_t *iter;
 162     unsigned i;
 163
 164     while(!list_empty(&dispex_data_list)) {
 165         iter = LIST_ENTRY(list_head(&dispex_data_list), dispex_data_t, entry);
 166         list_remove(&iter->entry);
 167
 168         for(i=0; i < iter->func_cnt; i++)
 169             SysFreeString(iter->funcs[i].name);
 170
 171         heap_free(iter->funcs);
 172         heap_free(iter->name_table);
 173         heap_free(iter);
 174     }
 175
 176     if(!typelib)
 177         return;
 178
 179     for(i=0; i < sizeof(typeinfos)/sizeof(*typeinfos); i++)
 180         if(typeinfos[i])
 181             ITypeInfo_Release(typeinfos[i]);
 182
 183     ITypeLib_Release(typelib);
 184     DeleteCriticalSection(&cs_dispex_static_data);
 185 }
 186
 187 HRESULT get_htmldoc_classinfo(ITypeInfo **typeinfo)
 188 {
 189     HRESULT hres;
 190
 191     if (!typelib)
 192         hres = load_typelib();
 193     if (!typelib)
 194         return hres;
 195
 196     hres = ITypeLib_GetTypeInfoOfGuid(typelib, &CLSID_HTMLDocument, typeinfo);
 197     if(FAILED(hres))
 198         ERR("GetTypeInfoOfGuid failed: %08x\n", hres);
 199     return hres;
 200 }
 201
 202 /* Not all argument types are supported yet */
 203 #define BUILTIN_ARG_TYPES_SWITCH                        \
 204     CASE_VT(VT_I2, INT16, V_I2);                        \
 205     CASE_VT(VT_I4, INT32, V_I4);                        \
 206     CASE_VT(VT_R4, float, V_R4);                        \
 207     CASE_VT(VT_BSTR, BSTR, V_BSTR);                     \
 208     CASE_VT(VT_BOOL, VARIANT_BOOL, V_BOOL)
 209
 210 /* List all types used by IDispatchEx-based properties */
 211 #define BUILTIN_TYPES_SWITCH                            \
 212     BUILTIN_ARG_TYPES_SWITCH;                           \
 213     CASE_VT(VT_VARIANT, VARIANT, *);                    \
 214     CASE_VT(VT_PTR, void*, V_BYREF);                    \
 215     CASE_VT(VT_UNKNOWN, IUnknown*, V_UNKNOWN);          \
 216     CASE_VT(VT_DISPATCH, IDispatch*, V_DISPATCH)
 217
 218 static BOOL is_arg_type_supported(VARTYPE vt)
 219 {
 220     switch(vt) {
 221 #define CASE_VT(x,a,b) case x: return TRUE
 222     BUILTIN_ARG_TYPES_SWITCH;
 223 #undef CASE_VT
 224     }
 225     return FALSE;
 226 }
 227
 228 static void add_func_info(dispex_data_t *data, DWORD *size, tid_t tid, const FUNCDESC *desc, ITypeInfo *dti)
 229 {
 230     func_info_t *info;
 231     HRESULT hres;
 232
 233     for(info = data->funcs; info < data->funcs+data->func_cnt; info++) {
 234         if(info->id == desc->memid) {
 235             if(info->tid != tid)
 236                 return; /* Duplicated in other interface */
 237             break;
 238         }
 239     }
 240
 241     if(info == data->funcs+data->func_cnt) {
 242         if(data->func_cnt == *size)
 243             data->funcs = heap_realloc_zero(data->funcs, (*size <<= 1)*sizeof(func_info_t));
 244         info = data->funcs+data->func_cnt;
 245
 246         hres = ITypeInfo_GetDocumentation(dti, desc->memid, &info->name, NULL, NULL, NULL);
 247         if(FAILED(hres))
 248             return;
 249
 250         data->func_cnt++;
 251
 252         info->id = desc->memid;
 253         info->tid = tid;
 254         info->func_disp_idx = -1;
 255         info->prop_vt = VT_EMPTY;
 256     }
 257
 258     if(desc->invkind & DISPATCH_METHOD) {
 259         unsigned i;
 260
 261         info->func_disp_idx = data->func_disp_cnt++;
 262         info->argc = desc->cParams;
 263
 264         assert(info->argc < MAX_ARGS);
 265         assert(desc->funckind == FUNC_DISPATCH);
 266
 267         info->arg_types = heap_alloc(sizeof(*info->arg_types) * info->argc);
 268         if(!info->arg_types)
 269             return; /* FIXME: real error instead of fallback */
 270
 271         for(i=0; i < info->argc; i++)
 272             info->arg_types[i] = desc->lprgelemdescParam[i].tdesc.vt;
 273
 274         info->prop_vt = desc->elemdescFunc.tdesc.vt;
 275         if(info->prop_vt != VT_VOID && !is_arg_type_supported(info->prop_vt)) {
 276             TRACE("%s: return type %d\n", debugstr_w(info->name), info->prop_vt);
 277             return; /* Fallback to ITypeInfo::Invoke */
 278         }
 279
 280         if(desc->cParamsOpt) {
 281             TRACE("%s: optional params\n", debugstr_w(info->name));
 282             return; /* Fallback to ITypeInfo::Invoke */
 283         }
 284
 285         for(i=0; i < info->argc; i++) {
 286             if(!is_arg_type_supported(info->arg_types[i])) {
 287                 return; /* Fallback to ITypeInfo for unsupported arg types */
 288             }
 289
 290             if(desc->lprgelemdescParam[i].u.paramdesc.wParamFlags & PARAMFLAG_FHASDEFAULT) {
 291                 TRACE("%s param %d: default value\n", debugstr_w(info->name), i);
 292                 return; /* Fallback to ITypeInfo::Invoke */
 293             }
 294         }
 295
 296         assert(info->argc <= MAX_ARGS);
 297         assert(desc->callconv == CC_STDCALL);
 298
 299         info->call_vtbl_off = desc->oVft/sizeof(void*);
 300     }else if(desc->invkind & (DISPATCH_PROPERTYPUT|DISPATCH_PROPERTYGET)) {
 301         VARTYPE vt = VT_EMPTY;
 302
 303         if(desc->invkind & DISPATCH_PROPERTYGET) {
 304             vt = desc->elemdescFunc.tdesc.vt;
 305             info->get_vtbl_off = desc->oVft/sizeof(void*);
 306         }
 307         if(desc->invkind & DISPATCH_PROPERTYPUT) {
 308             assert(desc->cParams == 1);
 309             vt = desc->lprgelemdescParam->tdesc.vt;
 310             info->put_vtbl_off = desc->oVft/sizeof(void*);
 311         }
 312
 313         assert(info->prop_vt == VT_EMPTY || vt == info->prop_vt);
 314         info->prop_vt = vt;
 315     }
 316 }
 317
 318 static HRESULT process_interface(dispex_data_t *data, tid_t tid, ITypeInfo *disp_typeinfo, DWORD *size)
 319 {
 320     unsigned i = 7; /* skip IDispatch functions */
 321     ITypeInfo *typeinfo;
 322     FUNCDESC *funcdesc;
 323     HRESULT hres;
 324
 325     hres = get_typeinfo(tid, &typeinfo);
 326     if(FAILED(hres))
 327         return hres;
 328
 329     while(1) {
 330         hres = ITypeInfo_GetFuncDesc(typeinfo, i++, &funcdesc);
 331         if(FAILED(hres))
 332             break;
 333
 334         TRACE("adding...\n");
 335
 336         add_func_info(data, size, tid, funcdesc, disp_typeinfo ? disp_typeinfo : typeinfo);
 337         ITypeInfo_ReleaseFuncDesc(typeinfo, funcdesc);
 338     }
 339
 340     return S_OK;
 341 }
 342
 343 static int dispid_cmp(const void *p1, const void *p2)
 344 {
 345     return ((const func_info_t*)p1)->id - ((const func_info_t*)p2)->id;
 346 }
 347
 348 static int func_name_cmp(const void *p1, const void *p2)
 349 {
 350     return strcmpiW((*(func_info_t* const*)p1)->name, (*(func_info_t* const*)p2)->name);
 351 }
 352
 353 static dispex_data_t *preprocess_dispex_data(DispatchEx *This)
 354 {
 355     const tid_t *tid;
 356     dispex_data_t *data;
 357     DWORD size = 16, i;
 358     ITypeInfo *dti;
 359     HRESULT hres;
 360
 361     TRACE("(%p)\n", This);
 362
 363     if(This->data->disp_tid) {
 364         hres = get_typeinfo(This->data->disp_tid, &dti);
 365         if(FAILED(hres)) {
 366             ERR("Could not get disp type info: %08x\n", hres);
 367             return NULL;
 368         }
 369     }
 370
 371     data = heap_alloc(sizeof(dispex_data_t));
 372     if (!data) {
 373         ERR("Out of memory\n");
 374         return NULL;
 375     }
 376     data->func_cnt = 0;
 377     data->func_disp_cnt = 0;
 378     data->funcs = heap_alloc_zero(size*sizeof(func_info_t));
 379     if (!data->funcs) {
 380         heap_free (data);
 381         ERR("Out of memory\n");
 382         return NULL;
 383     }
 384     list_add_tail(&dispex_data_list, &data->entry);
 385
 386     for(tid = This->data->iface_tids; *tid; tid++) {
 387         hres = process_interface(data, *tid, dti, &size);
 388         if(FAILED(hres))
 389             break;
 390     }
 391
 392     if(This->data->additional_tid)
 393         process_interface(data, This->data->additional_tid, NULL, &size);
 394
 395     if(!data->func_cnt) {
 396         heap_free(data->funcs);
 397         data->name_table = NULL;
 398         data->funcs = NULL;
 399         return data;
 400     }
 401
 402
 403     data->funcs = heap_realloc(data->funcs, data->func_cnt * sizeof(func_info_t));
 404     qsort(data->funcs, data->func_cnt, sizeof(func_info_t), dispid_cmp);
 405
 406     data->name_table = heap_alloc(data->func_cnt * sizeof(func_info_t*));
 407     for(i=0; i < data->func_cnt; i++)
 408         data->name_table[i] = data->funcs+i;
 409     qsort(data->name_table, data->func_cnt, sizeof(func_info_t*), func_name_cmp);
 410     return data;
 411 }
 412
 413 static int id_cmp(const void *p1, const void *p2)
 414 {
 415     return *(const DISPID*)p1 - *(const DISPID*)p2;
 416 }
 417
 418 HRESULT get_dispids(tid_t tid, DWORD *ret_size, DISPID **ret)
 419 {
 420     unsigned i, func_cnt;
 421     FUNCDESC *funcdesc;
 422     ITypeInfo *ti;
 423     TYPEATTR *attr;
 424     DISPID *ids;
 425     HRESULT hres;
 426
 427     hres = get_typeinfo(tid, &ti);
 428     if(FAILED(hres))
 429         return hres;
 430
 431     hres = ITypeInfo_GetTypeAttr(ti, &attr);
 432     if(FAILED(hres)) {
 433         ITypeInfo_Release(ti);
 434         return hres;
 435     }
 436
 437     func_cnt = attr->cFuncs;
 438     ITypeInfo_ReleaseTypeAttr(ti, attr);
 439
 440     ids = heap_alloc(func_cnt*sizeof(DISPID));
 441     if(!ids) {
 442         ITypeInfo_Release(ti);
 443         return E_OUTOFMEMORY;
 444     }
 445
 446     for(i=0; i < func_cnt; i++) {
 447         hres = ITypeInfo_GetFuncDesc(ti, i, &funcdesc);
 448         if(FAILED(hres))
 449             break;
 450
 451         ids[i] = funcdesc->memid;
 452         ITypeInfo_ReleaseFuncDesc(ti, funcdesc);
 453     }
 454
 455     ITypeInfo_Release(ti);
 456     if(FAILED(hres)) {
 457         heap_free(ids);
 458         return hres;
 459     }
 460
 461     qsort(ids, func_cnt, sizeof(DISPID), id_cmp);
 462
 463     *ret_size = func_cnt;
 464     *ret = ids;
 465     return S_OK;
 466 }
 467
 468 static dispex_data_t *get_dispex_data(DispatchEx *This)
 469 {
 470     if(This->data->data)
 471         return This->data->data;
 472
 473     EnterCriticalSection(&cs_dispex_static_data);
 474
 475     if(!This->data->data)
 476         This->data->data = preprocess_dispex_data(This);
 477
 478     LeaveCriticalSection(&cs_dispex_static_data);
 479
 480     return This->data->data;
 481 }
 482
 483 static inline BOOL is_custom_dispid(DISPID id)
 484 {
 485     return MSHTML_DISPID_CUSTOM_MIN <= id && id <= MSHTML_DISPID_CUSTOM_MAX;
 486 }
 487
 488 static inline BOOL is_dynamic_dispid(DISPID id)
 489 {
 490     return DISPID_DYNPROP_0 <= id && id <= DISPID_DYNPROP_MAX;
 491 }
 492
 493 dispex_prop_type_t get_dispid_type(DISPID id)
 494 {
 495     if(is_dynamic_dispid(id))
 496         return DISPEXPROP_DYNAMIC;
 497     if(is_custom_dispid(id))
 498         return DISPEXPROP_CUSTOM;
 499     return DISPEXPROP_BUILTIN;
 500 }
 501
 502 static HRESULT variant_copy(VARIANT *dest, VARIANT *src)
 503 {
 504     if(V_VT(src) == VT_BSTR && !V_BSTR(src)) {
 505         V_VT(dest) = VT_BSTR;
 506         V_BSTR(dest) = NULL;
 507         return S_OK;
 508     }
 509
 510     return VariantCopy(dest, src);
 511 }
 512
 513 static inline dispex_dynamic_data_t *get_dynamic_data(DispatchEx *This)
 514 {
 515     if(This->dynamic_data)
 516         return This->dynamic_data;
 517
 518     This->dynamic_data = heap_alloc_zero(sizeof(dispex_dynamic_data_t));
 519     if(!This->dynamic_data)
 520         return NULL;
 521
 522     if(This->data->vtbl && This->data->vtbl->populate_props)
 523         This->data->vtbl->populate_props(This);
 524
 525     return This->dynamic_data;
 526 }
 527
 528 static HRESULT get_dynamic_prop(DispatchEx *This, const WCHAR *name, DWORD flags, dynamic_prop_t **ret)
 529 {
 530     const BOOL alloc = flags & fdexNameEnsure;
 531     dispex_dynamic_data_t *data;
 532     dynamic_prop_t *prop;
 533
 534     data = get_dynamic_data(This);
 535     if(!data)
 536         return E_OUTOFMEMORY;
 537
 538     for(prop = data->props; prop < data->props+data->prop_cnt; prop++) {
 539         if(flags & fdexNameCaseInsensitive ? !strcmpiW(prop->name, name) : !strcmpW(prop->name, name)) {
 540             if(prop->flags & DYNPROP_DELETED) {
 541                 if(!alloc)
 542                     return DISP_E_UNKNOWNNAME;
 543                 prop->flags &= ~DYNPROP_DELETED;
 544             }
 545             *ret = prop;
 546             return S_OK;
 547         }
 548     }
 549
 550     if(!alloc)
 551         return DISP_E_UNKNOWNNAME;
 552
 553     TRACE("creating dynamic prop %s\n", debugstr_w(name));
 554
 555     if(!data->buf_size) {
 556         data->props = heap_alloc(sizeof(dynamic_prop_t)*4);
 557         if(!data->props)
 558             return E_OUTOFMEMORY;
 559         data->buf_size = 4;
 560     }else if(data->buf_size == data->prop_cnt) {
 561         dynamic_prop_t *new_props;
 562
 563         new_props = heap_realloc(data->props, sizeof(dynamic_prop_t)*(data->buf_size<<1));
 564         if(!new_props)
 565             return E_OUTOFMEMORY;
 566
 567         data->props = new_props;
 568         data->buf_size <<= 1;
 569     }
 570
 571     prop = data->props + data->prop_cnt;
 572
 573     prop->name = heap_strdupW(name);
 574     if(!prop->name)
 575         return E_OUTOFMEMORY;
 576
 577     VariantInit(&prop->var);
 578     prop->flags = 0;
 579     data->prop_cnt++;
 580     *ret = prop;
 581     return S_OK;
 582 }
 583
 584 HRESULT dispex_get_dprop_ref(DispatchEx *This, const WCHAR *name, BOOL alloc, VARIANT **ret)
 585 {
 586     dynamic_prop_t *prop;
 587     HRESULT hres;
 588
 589     hres = get_dynamic_prop(This, name, alloc ? fdexNameEnsure : 0, &prop);
 590     if(FAILED(hres))
 591         return hres;
 592
 593     *ret = &prop->var;
 594     return S_OK;
 595 }
 596
 597 HRESULT dispex_get_dynid(DispatchEx *This, const WCHAR *name, DISPID *id)
 598 {
 599     dynamic_prop_t *prop;
 600     HRESULT hres;
 601
 602     hres = get_dynamic_prop(This, name, fdexNameEnsure, &prop);
 603     if(FAILED(hres))
 604         return hres;
 605
 606     *id = DISPID_DYNPROP_0 + (prop - This->dynamic_data->props);
 607     return S_OK;
 608 }
 609
 610 static HRESULT dispex_value(DispatchEx *This, LCID lcid, WORD flags, DISPPARAMS *params,
 611         VARIANT *res, EXCEPINFO *ei, IServiceProvider *caller)
 612 {
 613     if(This->data->vtbl && This->data->vtbl->value)
 614         return This->data->vtbl->value(This, lcid, flags, params, res, ei, caller);
 615
 616     switch(flags) {
 617     case DISPATCH_PROPERTYGET:
 618         V_VT(res) = VT_BSTR;
 619         V_BSTR(res) = SysAllocString(objectW);
 620         if(!V_BSTR(res))
 621             return E_OUTOFMEMORY;
 622         break;
 623     default:
 624         FIXME("Unimplemented flags %x\n", flags);
 625         return E_NOTIMPL;
 626     }
 627
 628     return S_OK;
 629 }
 630
 631 static HRESULT typeinfo_invoke(DispatchEx *This, func_info_t *func, WORD flags, DISPPARAMS *dp, VARIANT *res,
 632         EXCEPINFO *ei)
 633 {
 634     DISPPARAMS params = {dp->rgvarg+dp->cNamedArgs, NULL, dp->cArgs-dp->cNamedArgs, 0};
 635     ITypeInfo *ti;
 636     IUnknown *unk;
 637     UINT argerr=0;
 638     HRESULT hres;
 639
 640     hres = get_typeinfo(func->tid, &ti);
 641     if(FAILED(hres)) {
 642         ERR("Could not get type info: %08x\n", hres);
 643         return hres;
 644     }
 645
 646     hres = IUnknown_QueryInterface(This->outer, tid_ids[func->tid], (void**)&unk);
 647     if(FAILED(hres)) {
 648         ERR("Could not get iface %s: %08x\n", debugstr_mshtml_guid(tid_ids[func->tid]), hres);
 649         return E_FAIL;
 650     }
 651
 652     hres = ITypeInfo_Invoke(ti, unk, func->id, flags, &params, res, ei, &argerr);
 653
 654     IUnknown_Release(unk);
 655     return hres;
 656 }
 657
 658 static inline func_disp_t *impl_from_IUnknown(IUnknown *iface)
 659 {
 660     return CONTAINING_RECORD(iface, func_disp_t, IUnknown_iface);
 661 }
 662
 663 static HRESULT WINAPI Function_QueryInterface(IUnknown *iface, REFIID riid, void **ppv)
 664 {
 665     func_disp_t *This = impl_from_IUnknown(iface);
 666
 667     TRACE("(%p)->(%s %p)\n", This, debugstr_mshtml_guid(riid), ppv);
 668
 669     if(IsEqualGUID(&IID_IUnknown, riid)) {
 670         *ppv = &This->IUnknown_iface;
 671     }else if(dispex_query_interface(&This->dispex, riid, ppv)) {
 672         return *ppv ? S_OK : E_NOINTERFACE;
 673     }else {
 674         *ppv = NULL;
 675         return E_NOINTERFACE;
 676     }
 677
 678     IUnknown_AddRef((IUnknown*)*ppv);
 679     return S_OK;
 680 }
 681
 682 static ULONG WINAPI Function_AddRef(IUnknown *iface)
 683 {
 684     func_disp_t *This = impl_from_IUnknown(iface);
 685     LONG ref = InterlockedIncrement(&This->ref);
 686
 687     TRACE("(%p) ref=%d\n", This, ref);
 688
 689     return ref;
 690 }
 691
 692 static ULONG WINAPI Function_Release(IUnknown *iface)
 693 {
 694     func_disp_t *This = impl_from_IUnknown(iface);
 695     LONG ref = InterlockedDecrement(&This->ref);
 696
 697     TRACE("(%p) ref=%d\n", This, ref);
 698
 699     if(!ref) {
 700         assert(!This->obj);
 701         release_dispex(&This->dispex);
 702         heap_free(This);
 703     }
 704
 705     return ref;
 706 }
 707
 708 static const IUnknownVtbl FunctionUnkVtbl = {
 709     Function_QueryInterface,
 710     Function_AddRef,
 711     Function_Release
 712 };
 713
 714 static inline func_disp_t *impl_from_DispatchEx(DispatchEx *iface)
 715 {
 716     return CONTAINING_RECORD(iface, func_disp_t, dispex);
 717 }
 718
 719 static HRESULT function_value(DispatchEx *dispex, LCID lcid, WORD flags, DISPPARAMS *params,
 720         VARIANT *res, EXCEPINFO *ei, IServiceProvider *caller)
 721 {
 722     func_disp_t *This = impl_from_DispatchEx(dispex);
 723     HRESULT hres;
 724
 725     switch(flags) {
 726     case DISPATCH_METHOD|DISPATCH_PROPERTYGET:
 727         if(!res)
 728             return E_INVALIDARG;
 729         /* fall through */
 730     case DISPATCH_METHOD:
 731         if(!This->obj)
 732             return E_UNEXPECTED;
 733         hres = typeinfo_invoke(This->obj, This->info, flags, params, res, ei);
 734         break;
 735     case DISPATCH_PROPERTYGET: {
 736         unsigned name_len;
 737         WCHAR *ptr;
 738         BSTR str;
 739
 740         static const WCHAR func_prefixW[] =
 741             {'\n','f','u','n','c','t','i','o','n',' '};
 742         static const WCHAR func_suffixW[] =
 743             {'(',')',' ','{','\n',' ',' ',' ',' ','[','n','a','t','i','v','e',' ','c','o','d','e',']','\n','}','\n'};
 744
 745         /* FIXME: This probably should be more generic. Also we should try to get IID_IActiveScriptSite and SID_GetCaller. */
 746         if(!caller)
 747             return E_ACCESSDENIED;
 748
 749         name_len = SysStringLen(This->info->name);
 750         ptr = str = SysAllocStringLen(NULL, name_len + (sizeof(func_prefixW)+sizeof(func_suffixW))/sizeof(WCHAR));
 751         if(!str)
 752             return E_OUTOFMEMORY;
 753
 754         memcpy(ptr, func_prefixW, sizeof(func_prefixW));
 755         ptr += sizeof(func_prefixW)/sizeof(WCHAR);
 756
 757         memcpy(ptr, This->info->name, name_len*sizeof(WCHAR));
 758         ptr += name_len;
 759
 760         memcpy(ptr, func_suffixW, sizeof(func_suffixW));
 761
 762         V_VT(res) = VT_BSTR;
 763         V_BSTR(res) = str;
 764         return S_OK;
 765     }
 766     default:
 767         FIXME("Unimplemented flags %x\n", flags);
 768         hres = E_NOTIMPL;
 769     }
 770
 771     return hres;
 772 }
 773
 774 static const dispex_static_data_vtbl_t function_dispex_vtbl = {
 775     function_value,
 776     NULL,
 777     NULL,
 778     NULL
 779 };
 780
 781 static const tid_t function_iface_tids[] = {0};
 782
 783 static dispex_static_data_t function_dispex = {
 784     &function_dispex_vtbl,
 785     NULL_tid,
 786     NULL,
 787     function_iface_tids
 788 };
 789
 790 static func_disp_t *create_func_disp(DispatchEx *obj, func_info_t *info)
 791 {
 792     func_disp_t *ret;
 793
 794     ret = heap_alloc_zero(sizeof(func_disp_t));
 795     if(!ret)
 796         return NULL;
 797
 798     ret->IUnknown_iface.lpVtbl = &FunctionUnkVtbl;
 799     init_dispex(&ret->dispex, &ret->IUnknown_iface,  &function_dispex);
 800     ret->ref = 1;
 801     ret->obj = obj;
 802     ret->info = info;
 803
 804     return ret;
 805 }
 806
 807 static HRESULT invoke_disp_value(DispatchEx *This, IDispatch *func_disp, LCID lcid, WORD flags, DISPPARAMS *dp,
 808         VARIANT *res, EXCEPINFO *ei, IServiceProvider *caller)
 809 {
 810     DISPID named_arg = DISPID_THIS;
 811     DISPPARAMS new_dp = {NULL, &named_arg, 0, 1};
 812     IDispatchEx *dispex;
 813     HRESULT hres;
 814
 815     if(dp->cNamedArgs) {
 816         FIXME("named args not supported\n");
 817         return E_NOTIMPL;
 818     }
 819
 820     new_dp.rgvarg = heap_alloc((dp->cArgs+1)*sizeof(VARIANTARG));
 821     if(!new_dp.rgvarg)
 822         return E_OUTOFMEMORY;
 823
 824     new_dp.cArgs = dp->cArgs+1;
 825     memcpy(new_dp.rgvarg+1, dp->rgvarg, dp->cArgs*sizeof(VARIANTARG));
 826
 827     V_VT(new_dp.rgvarg) = VT_DISPATCH;
 828     V_DISPATCH(new_dp.rgvarg) = (IDispatch*)&This->IDispatchEx_iface;
 829
 830     hres = IDispatch_QueryInterface(func_disp, &IID_IDispatchEx, (void**)&dispex);
 831     TRACE(">>>\n");
 832     if(SUCCEEDED(hres)) {
 833         hres = IDispatchEx_InvokeEx(dispex, DISPID_VALUE, lcid, flags, &new_dp, res, ei, caller);
 834         IDispatchEx_Release(dispex);
 835     }else {
 836         ULONG err = 0;
 837         hres = IDispatch_Invoke(func_disp, DISPID_VALUE, &IID_NULL, lcid, flags, &new_dp, res, ei, &err);
 838     }
 839     if(SUCCEEDED(hres))
 840         TRACE("<<< %s\n", debugstr_variant(res));
 841     else
 842         WARN("<<< %08x\n", hres);
 843
 844     heap_free(new_dp.rgvarg);
 845     return hres;
 846 }
 847
 848 static HRESULT get_func_obj_entry(DispatchEx *This, func_info_t *func, func_obj_entry_t **ret)
 849 {
 850     dispex_dynamic_data_t *dynamic_data;
 851     func_obj_entry_t *entry;
 852
 853     dynamic_data = get_dynamic_data(This);
 854     if(!dynamic_data)
 855         return E_OUTOFMEMORY;
 856
 857     if(!dynamic_data->func_disps) {
 858         dynamic_data->func_disps = heap_alloc_zero(This->data->data->func_disp_cnt * sizeof(*dynamic_data->func_disps));
 859         if(!dynamic_data->func_disps)
 860             return E_OUTOFMEMORY;
 861     }
 862
 863     entry = dynamic_data->func_disps + func->func_disp_idx;
 864     if(!entry->func_obj) {
 865         entry->func_obj = create_func_disp(This, func);
 866         if(!entry->func_obj)
 867             return E_OUTOFMEMORY;
 868
 869         IDispatchEx_AddRef(&entry->func_obj->dispex.IDispatchEx_iface);
 870         V_VT(&entry->val) = VT_DISPATCH;
 871         V_DISPATCH(&entry->val) = (IDispatch*)&entry->func_obj->dispex.IDispatchEx_iface;
 872     }
 873
 874     *ret = entry;
 875     return S_OK;
 876 }
 877
 878 static HRESULT get_builtin_func(dispex_data_t *data, DISPID id, func_info_t **ret)
 879 {
 880     int min, max, n;
 881
 882     min = 0;
 883     max = data->func_cnt-1;
 884
 885     while(min <= max) {
 886         n = (min+max)/2;
 887
 888         if(data->funcs[n].id == id) {
 889             *ret = data->funcs+n;
 890             return S_OK;
 891         }
 892
 893         if(data->funcs[n].id < id)
 894             min = n+1;
 895         else
 896             max = n-1;
 897     }
 898
 899     WARN("invalid id %x\n", id);
 900     return DISP_E_UNKNOWNNAME;
 901 }
 902
 903 static HRESULT get_builtin_id(DispatchEx *This, BSTR name, DWORD grfdex, DISPID *ret)
 904 {
 905     dispex_data_t *data;
 906     int min, max, n, c;
 907
 908     data = get_dispex_data(This);
 909     if(!data)
 910         return E_FAIL;
 911
 912     min = 0;
 913     max = data->func_cnt-1;
 914
 915     while(min <= max) {
 916         n = (min+max)/2;
 917
 918         c = strcmpiW(data->name_table[n]->name, name);
 919         if(!c) {
 920             if((grfdex & fdexNameCaseSensitive) && strcmpW(data->name_table[n]->name, name))
 921                 break;
 922
 923             *ret = data->name_table[n]->id;
 924             return S_OK;
 925         }
 926
 927         if(c > 0)
 928             max = n-1;
 929         else
 930             min = n+1;
 931     }
 932
 933     if(This->data->vtbl && This->data->vtbl->get_dispid) {
 934         HRESULT hres;
 935
 936         hres = This->data->vtbl->get_dispid(This, name, grfdex, ret);
 937         if(hres != DISP_E_UNKNOWNNAME)
 938             return hres;
 939     }
 940
 941     return DISP_E_UNKNOWNNAME;
 942 }
 943
 944 static HRESULT change_type(VARIANT *dst, VARIANT *src, VARTYPE vt, IServiceProvider *caller)
 945 {
 946     V_VT(dst) = VT_EMPTY;
 947
 948     if(caller) {
 949         IVariantChangeType *change_type = NULL;
 950         HRESULT hres;
 951
 952         hres = IServiceProvider_QueryService(caller, &SID_VariantConversion, &IID_IVariantChangeType, (void**)&change_type);
 953         if(SUCCEEDED(hres)) {
 954             hres = IVariantChangeType_ChangeType(change_type, dst, src, LOCALE_NEUTRAL, vt);
 955             IVariantChangeType_Release(change_type);
 956             return hres;
 957         }
 958     }
 959
 960     switch(vt) {
 961     case VT_BOOL:
 962         if(V_VT(src) == VT_BSTR) {
 963             V_VT(dst) = VT_BOOL;
 964             V_BOOL(dst) = V_BSTR(src) && *V_BSTR(src) ? VARIANT_TRUE : VARIANT_FALSE;
 965             return S_OK;
 966         }
 967         break;
 968     }
 969
 970     return VariantChangeType(dst, src, 0, vt);
 971 }
 972
 973 static HRESULT builtin_propget(DispatchEx *This, func_info_t *func, DISPPARAMS *dp, VARIANT *res)
 974 {
 975     IUnknown *iface;
 976     HRESULT hres;
 977
 978     if(dp && dp->cArgs) {
 979         FIXME("cArgs %d\n", dp->cArgs);
 980         return E_NOTIMPL;
 981     }
 982
 983     assert(func->get_vtbl_off);
 984
 985     hres = IUnknown_QueryInterface(This->outer, tid_ids[func->tid], (void**)&iface);
 986     if(SUCCEEDED(hres)) {
 987         switch(func->prop_vt) {
 988 #define CASE_VT(vt,type,access) \
 989         case vt: { \
 990             type val; \
 991             hres = ((HRESULT (WINAPI*)(IUnknown*,type*))((void**)iface->lpVtbl)[func->get_vtbl_off])(iface,&val); \
 992             if(SUCCEEDED(hres)) \
 993                 access(res) = val; \
 994             } \
 995             break
 996         BUILTIN_TYPES_SWITCH;
 997 #undef CASE_VT
 998         default:
 999             FIXME("Unhandled vt %d\n", func->prop_vt);
1000             hres = E_NOTIMPL;
1001         }
1002         IUnknown_Release(iface);
1003     }
1004
1005     if(FAILED(hres))
1006         return hres;
1007
1008     if(func->prop_vt != VT_VARIANT)
1009         V_VT(res) = func->prop_vt == VT_PTR ? VT_DISPATCH : func->prop_vt;
1010     return S_OK;
1011 }
1012
1013 static HRESULT builtin_propput(DispatchEx *This, func_info_t *func, DISPPARAMS *dp, IServiceProvider *caller)
1014 {
1015     VARIANT *v, tmpv;
1016     IUnknown *iface;
1017     HRESULT hres;
1018
1019     if(dp->cArgs != 1 || (dp->cNamedArgs == 1 && *dp->rgdispidNamedArgs != DISPID_PROPERTYPUT)
1020             || dp->cNamedArgs > 1) {
1021         FIXME("invalid args\n");
1022         return E_INVALIDARG;
1023     }
1024
1025     if(!func->put_vtbl_off) {
1026         FIXME("No setter\n");
1027         return E_FAIL;
1028     }
1029
1030     v = dp->rgvarg;
1031     if(func->prop_vt != VT_VARIANT && V_VT(v) != func->prop_vt) {
1032         hres = change_type(&tmpv, v, func->prop_vt, caller);
1033         if(FAILED(hres))
1034             return hres;
1035         v = &tmpv;
1036     }
1037
1038     hres = IUnknown_QueryInterface(This->outer, tid_ids[func->tid], (void**)&iface);
1039     if(SUCCEEDED(hres)) {
1040         switch(func->prop_vt) {
1041 #define CASE_VT(vt,type,access) \
1042         case vt: \
1043             hres = ((HRESULT (WINAPI*)(IUnknown*,type))((void**)iface->lpVtbl)[func->put_vtbl_off])(iface,access(v)); \
1044             break
1045         BUILTIN_TYPES_SWITCH;
1046 #undef CASE_VT
1047         default:
1048             FIXME("Unimplemented vt %d\n", func->prop_vt);
1049             hres = E_NOTIMPL;
1050         }
1051
1052         IUnknown_Release(iface);
1053     }
1054
1055     if(v == &tmpv)
1056         VariantClear(v);
1057     return hres;
1058 }
1059
1060 static HRESULT invoke_builtin_function(DispatchEx *This, func_info_t *func, DISPPARAMS *dp, VARIANT *res, IServiceProvider *caller)
1061 {
1062     VARIANT arg_buf[MAX_ARGS], *arg_ptrs[MAX_ARGS], *arg, retv, ret_ref, vhres;
1063     unsigned i, nconv = 0;
1064     IUnknown *iface;
1065     HRESULT hres;
1066
1067     if(dp->cNamedArgs) {
1068         FIXME("Named arguments not supported\n");
1069         return E_NOTIMPL;
1070     }
1071
1072     if(dp->cArgs != func->argc) {
1073         FIXME("Invalid argument count (expected %u, got %u)\n", func->argc, dp->cArgs);
1074         return E_INVALIDARG;
1075     }
1076
1077     hres = IUnknown_QueryInterface(This->outer, tid_ids[func->tid], (void**)&iface);
1078     if(FAILED(hres))
1079         return hres;
1080
1081     for(i=0; i < func->argc; i++) {
1082         arg = dp->rgvarg+dp->cArgs-i-1;
1083         if(func->arg_types[i] == V_VT(arg)) {
1084             arg_ptrs[i] = arg;
1085         }else {
1086             hres = change_type(arg_buf+nconv, arg, func->arg_types[i], caller);
1087             if(FAILED(hres))
1088                 break;
1089             arg_ptrs[i] = arg_buf + nconv++;
1090         }
1091     }
1092
1093     if(SUCCEEDED(hres)) {
1094         if(func->prop_vt == VT_VOID) {
1095             V_VT(&retv) = VT_EMPTY;
1096         }else {
1097             V_VT(&retv) = func->prop_vt;
1098             arg_ptrs[func->argc] = &ret_ref;
1099             V_VT(&ret_ref) = VT_BYREF|func->prop_vt;
1100
1101             switch(func->prop_vt) {
1102 #define CASE_VT(vt,type,access)                         \
1103             case vt:                                    \
1104                 V_BYREF(&ret_ref) = &access(&retv);     \
1105                 break
1106             BUILTIN_TYPES_SWITCH;
1107 #undef CASE_VT
1108             default:
1109                 assert(0);
1110             }
1111         }
1112
1113         V_VT(&vhres) = VT_ERROR;
1114         hres = DispCallFunc(iface, func->call_vtbl_off*sizeof(void*), CC_STDCALL, VT_ERROR,
1115                     func->argc + (func->prop_vt == VT_VOID ? 0 : 1), func->arg_types, arg_ptrs, &vhres);
1116     }
1117
1118     while(nconv--)
1119         VariantClear(arg_buf+nconv);
1120     IUnknown_Release(iface);
1121     if(FAILED(hres))
1122         return hres;
1123     if(FAILED(V_ERROR(&vhres)))
1124         return V_ERROR(&vhres);
1125
1126     if(res)
1127         *res = retv;
1128     else
1129         VariantClear(&retv);
1130     return V_ERROR(&vhres);
1131 }
1132
1133 static HRESULT function_invoke(DispatchEx *This, func_info_t *func, WORD flags, DISPPARAMS *dp, VARIANT *res,
1134         EXCEPINFO *ei, IServiceProvider *caller)
1135 {
1136     HRESULT hres;
1137
1138     switch(flags) {
1139     case DISPATCH_METHOD|DISPATCH_PROPERTYGET:
1140         if(!res)
1141             return E_INVALIDARG;
1142         /* fall through */
1143     case DISPATCH_METHOD:
1144         if(This->dynamic_data && This->dynamic_data->func_disps
1145            && This->dynamic_data->func_disps[func->func_disp_idx].func_obj) {
1146             func_obj_entry_t *entry = This->dynamic_data->func_disps + func->func_disp_idx;
1147
1148             if(V_VT(&entry->val) != VT_DISPATCH) {
1149                 FIXME("calling %s not supported\n", debugstr_variant(&entry->val));
1150                 return E_NOTIMPL;
1151             }
1152
1153             if((IDispatch*)&entry->func_obj->dispex.IDispatchEx_iface != V_DISPATCH(&entry->val)) {
1154                 if(!V_DISPATCH(&entry->val)) {
1155                     FIXME("Calling null\n");
1156                     return E_FAIL;
1157                 }
1158
1159                 hres = invoke_disp_value(This, V_DISPATCH(&entry->val), 0, flags, dp, res, ei, NULL);
1160                 break;
1161             }
1162         }
1163
1164         if(func->call_vtbl_off)
1165             hres = invoke_builtin_function(This, func, dp, res, caller);
1166         else
1167             hres = typeinfo_invoke(This, func, flags, dp, res, ei);
1168         break;
1169     case DISPATCH_PROPERTYGET: {
1170         func_obj_entry_t *entry;
1171
1172         if(func->id == DISPID_VALUE) {
1173             BSTR ret;
1174
1175             ret = SysAllocString(objectW);
1176             if(!ret)
1177                 return E_OUTOFMEMORY;
1178
1179             V_VT(res) = VT_BSTR;
1180             V_BSTR(res) = ret;
1181             return S_OK;
1182         }
1183
1184         hres = get_func_obj_entry(This, func, &entry);
1185         if(FAILED(hres))
1186             return hres;
1187
1188         V_VT(res) = VT_EMPTY;
1189         return VariantCopy(res, &entry->val);
1190     }
1191     case DISPATCH_PROPERTYPUT: {
1192         func_obj_entry_t *entry;
1193
1194         if(dp->cArgs != 1 || (dp->cNamedArgs == 1 && *dp->rgdispidNamedArgs != DISPID_PROPERTYPUT)
1195            || dp->cNamedArgs > 1) {
1196             FIXME("invalid args\n");
1197             return E_INVALIDARG;
1198         }
1199
1200         /*
1201          * NOTE: Although we have IDispatchEx tests showing, that it's not allowed to set
1202          * function property using InvokeEx, it's possible to do that from jscript.
1203          * Native probably uses some undocumented interface in this case, but it should
1204          * be fine for us to allow IDispatchEx handle that.
1205          */
1206         hres = get_func_obj_entry(This, func, &entry);
1207         if(FAILED(hres))
1208             return hres;
1209
1210         return VariantCopy(&entry->val, dp->rgvarg);
1211     }
1212     default:
1213         FIXME("Unimplemented flags %x\n", flags);
1214         hres = E_NOTIMPL;
1215     }
1216
1217     return hres;
1218 }
1219
1220 static HRESULT invoke_builtin_prop(DispatchEx *This, DISPID id, LCID lcid, WORD flags, DISPPARAMS *dp,
1221         VARIANT *res, EXCEPINFO *ei, IServiceProvider *caller)
1222 {
1223     dispex_data_t *data;
1224     func_info_t *func;
1225     HRESULT hres;
1226
1227     data = get_dispex_data(This);
1228     if(!data)
1229         return E_FAIL;
1230
1231     hres = get_builtin_func(data, id, &func);
1232     if(id == DISPID_VALUE && hres == DISP_E_UNKNOWNNAME)
1233         return dispex_value(This, lcid, flags, dp, res, ei, caller);
1234     if(FAILED(hres))
1235         return hres;
1236
1237     if(func->func_disp_idx != -1)
1238         return function_invoke(This, func, flags, dp, res, ei, caller);
1239
1240     switch(flags) {
1241     case DISPATCH_PROPERTYPUT:
1242         if(res)
1243             V_VT(res) = VT_EMPTY;
1244         hres = builtin_propput(This, func, dp, caller);
1245         break;
1246     case DISPATCH_PROPERTYGET:
1247         hres = builtin_propget(This, func, dp, res);
1248         break;
1249     default:
1250         if(!func->get_vtbl_off) {
1251             hres = typeinfo_invoke(This, func, flags, dp, res, ei);
1252         }else {
1253             VARIANT v;
1254
1255             hres = builtin_propget(This, func, NULL, &v);
1256             if(FAILED(hres))
1257                 return hres;
1258
1259             if(flags != (DISPATCH_PROPERTYGET|DISPATCH_METHOD) || dp->cArgs) {
1260                 if(V_VT(&v) != VT_DISPATCH) {
1261                     FIXME("Not a function %s flags %08x\n", debugstr_variant(&v), flags);
1262                     VariantClear(&v);
1263                     return E_FAIL;
1264                 }
1265
1266                 hres = invoke_disp_value(This, V_DISPATCH(&v), lcid, flags, dp, res, ei, caller);
1267                 IDispatch_Release(V_DISPATCH(&v));
1268             }else if(res) {
1269                 *res = v;
1270             }else {
1271                 VariantClear(&v);
1272             }
1273         }
1274     }
1275
1276     return hres;
1277 }
1278
1279 HRESULT remove_attribute(DispatchEx *This, DISPID id, VARIANT_BOOL *success)
1280 {
1281     switch(get_dispid_type(id)) {
1282     case DISPEXPROP_CUSTOM:
1283         FIXME("DISPEXPROP_CUSTOM not supported\n");
1284         return E_NOTIMPL;
1285
1286     case DISPEXPROP_DYNAMIC: {
1287         DWORD idx = id - DISPID_DYNPROP_0;
1288         dynamic_prop_t *prop;
1289
1290         prop = This->dynamic_data->props+idx;
1291         VariantClear(&prop->var);
1292         prop->flags |= DYNPROP_DELETED;
1293         *success = VARIANT_TRUE;
1294         return S_OK;
1295     }
1296     case DISPEXPROP_BUILTIN: {
1297         VARIANT var;
1298         DISPPARAMS dp = {&var,NULL,1,0};
1299         dispex_data_t *data;
1300         func_info_t *func;
1301         HRESULT hres;
1302
1303         data = get_dispex_data(This);
1304         if(!data)
1305             return E_FAIL;
1306
1307         hres = get_builtin_func(data, id, &func);
1308         if(FAILED(hres))
1309             return hres;
1310
1311         /* For builtin functions, we set their value to the original function. */
1312         if(func->func_disp_idx != -1) {
1313             func_obj_entry_t *entry;
1314
1315             if(!This->dynamic_data || !This->dynamic_data->func_disps
1316                 || !This->dynamic_data->func_disps[func->func_disp_idx].func_obj) {
1317                 *success = VARIANT_FALSE;
1318                 return S_OK;
1319             }
1320
1321             entry = This->dynamic_data->func_disps + func->func_disp_idx;
1322             if(V_VT(&entry->val) == VT_DISPATCH
1323                     && V_DISPATCH(&entry->val) == (IDispatch*)&entry->func_obj->dispex.IDispatchEx_iface) {
1324                 *success = VARIANT_FALSE;
1325                 return S_OK;
1326             }
1327
1328             VariantClear(&entry->val);
1329             V_VT(&entry->val) = VT_DISPATCH;
1330             V_DISPATCH(&entry->val) = (IDispatch*)&entry->func_obj->dispex.IDispatchEx_iface;
1331             IDispatch_AddRef(V_DISPATCH(&entry->val));
1332             *success = VARIANT_TRUE;
1333             return S_OK;
1334         }
1335
1336         V_VT(&var) = VT_EMPTY;
1337         hres = builtin_propput(This, func, &dp, NULL);
1338         if(FAILED(hres))
1339             return hres;
1340
1341         *success = VARIANT_TRUE;
1342         return S_OK;
1343     }
1344     default:
1345         assert(0);
1346         return E_FAIL;
1347     }
1348 }
1349
1350 static inline DispatchEx *impl_from_IDispatchEx(IDispatchEx *iface)
1351 {
1352     return CONTAINING_RECORD(iface, DispatchEx, IDispatchEx_iface);
1353 }
1354
1355 static HRESULT WINAPI DispatchEx_QueryInterface(IDispatchEx *iface, REFIID riid, void **ppv)
1356 {
1357     DispatchEx *This = impl_from_IDispatchEx(iface);
1358
1359     return IUnknown_QueryInterface(This->outer, riid, ppv);
1360 }
1361
1362 static ULONG WINAPI DispatchEx_AddRef(IDispatchEx *iface)
1363 {
1364     DispatchEx *This = impl_from_IDispatchEx(iface);
1365
1366     return IUnknown_AddRef(This->outer);
1367 }
1368
1369 static ULONG WINAPI DispatchEx_Release(IDispatchEx *iface)
1370 {
1371     DispatchEx *This = impl_from_IDispatchEx(iface);
1372
1373     return IUnknown_Release(This->outer);
1374 }
1375
1376 static HRESULT WINAPI DispatchEx_GetTypeInfoCount(IDispatchEx *iface, UINT *pctinfo)
1377 {
1378     DispatchEx *This = impl_from_IDispatchEx(iface);
1379
1380     TRACE("(%p)->(%p)\n", This, pctinfo);
1381
1382     *pctinfo = 1;
1383     return S_OK;
1384 }
1385
1386 static HRESULT WINAPI DispatchEx_GetTypeInfo(IDispatchEx *iface, UINT iTInfo,
1387                                               LCID lcid, ITypeInfo **ppTInfo)
1388 {
1389     DispatchEx *This = impl_from_IDispatchEx(iface);
1390     HRESULT hres;
1391
1392     TRACE("(%p)->(%u %u %p)\n", This, iTInfo, lcid, ppTInfo);
1393
1394     hres = get_typeinfo(This->data->disp_tid, ppTInfo);
1395     if(FAILED(hres))
1396         return hres;
1397
1398     ITypeInfo_AddRef(*ppTInfo);
1399     return S_OK;
1400 }
1401
1402 static HRESULT WINAPI DispatchEx_GetIDsOfNames(IDispatchEx *iface, REFIID riid,
1403                                                 LPOLESTR *rgszNames, UINT cNames,
1404                                                 LCID lcid, DISPID *rgDispId)
1405 {
1406     DispatchEx *This = impl_from_IDispatchEx(iface);
1407     UINT i;
1408     HRESULT hres;
1409
1410     TRACE("(%p)->(%s %p %u %u %p)\n", This, debugstr_guid(riid), rgszNames, cNames,
1411           lcid, rgDispId);
1412
1413     for(i=0; i < cNames; i++) {
1414         hres = IDispatchEx_GetDispID(&This->IDispatchEx_iface, rgszNames[i], 0, rgDispId+i);
1415         if(FAILED(hres))
1416             return hres;
1417     }
1418
1419     return S_OK;
1420 }
1421
1422 static HRESULT WINAPI DispatchEx_Invoke(IDispatchEx *iface, DISPID dispIdMember,
1423                             REFIID riid, LCID lcid, WORD wFlags, DISPPARAMS *pDispParams,
1424                             VARIANT *pVarResult, EXCEPINFO *pExcepInfo, UINT *puArgErr)
1425 {
1426     DispatchEx *This = impl_from_IDispatchEx(iface);
1427
1428     TRACE("(%p)->(%d %s %d %d %p %p %p %p)\n", This, dispIdMember, debugstr_guid(riid),
1429           lcid, wFlags, pDispParams, pVarResult, pExcepInfo, puArgErr);
1430
1431     return IDispatchEx_InvokeEx(&This->IDispatchEx_iface, dispIdMember, lcid, wFlags, pDispParams,
1432             pVarResult, pExcepInfo, NULL);
1433 }
1434
1435 static HRESULT WINAPI DispatchEx_GetDispID(IDispatchEx *iface, BSTR bstrName, DWORD grfdex, DISPID *pid)
1436 {
1437     DispatchEx *This = impl_from_IDispatchEx(iface);
1438     dynamic_prop_t *dprop;
1439     HRESULT hres;
1440
1441     TRACE("(%p)->(%s %x %p)\n", This, debugstr_w(bstrName), grfdex, pid);
1442
1443     if(grfdex & ~(fdexNameCaseSensitive|fdexNameCaseInsensitive|fdexNameEnsure|fdexNameImplicit|FDEX_VERSION_MASK))
1444         FIXME("Unsupported grfdex %x\n", grfdex);
1445
1446     hres = get_builtin_id(This, bstrName, grfdex, pid);
1447     if(hres != DISP_E_UNKNOWNNAME)
1448         return hres;
1449
1450     hres = get_dynamic_prop(This, bstrName, grfdex, &dprop);
1451     if(FAILED(hres))
1452         return hres;
1453
1454     *pid = DISPID_DYNPROP_0 + (dprop - This->dynamic_data->props);
1455     return S_OK;
1456 }
1457
1458 static HRESULT WINAPI DispatchEx_InvokeEx(IDispatchEx *iface, DISPID id, LCID lcid, WORD wFlags, DISPPARAMS *pdp,
1459         VARIANT *pvarRes, EXCEPINFO *pei, IServiceProvider *pspCaller)
1460 {
1461     DispatchEx *This = impl_from_IDispatchEx(iface);
1462     HRESULT hres;
1463
1464     TRACE("(%p)->(%x %x %x %p %p %p %p)\n", This, id, lcid, wFlags, pdp, pvarRes, pei, pspCaller);
1465
1466     if(wFlags == (DISPATCH_PROPERTYPUT|DISPATCH_PROPERTYPUTREF))
1467         wFlags = DISPATCH_PROPERTYPUT;
1468
1469     switch(get_dispid_type(id)) {
1470     case DISPEXPROP_CUSTOM:
1471         if(!This->data->vtbl || !This->data->vtbl->invoke)
1472             return DISP_E_UNKNOWNNAME;
1473         return This->data->vtbl->invoke(This, id, lcid, wFlags, pdp, pvarRes, pei, pspCaller);
1474
1475     case DISPEXPROP_DYNAMIC: {
1476         DWORD idx = id - DISPID_DYNPROP_0;
1477         dynamic_prop_t *prop;
1478
1479         if(!get_dynamic_data(This) || This->dynamic_data->prop_cnt <= idx)
1480             return DISP_E_UNKNOWNNAME;
1481
1482         prop = This->dynamic_data->props+idx;
1483
1484         switch(wFlags) {
1485         case DISPATCH_METHOD|DISPATCH_PROPERTYGET:
1486             if(!pvarRes)
1487                 return E_INVALIDARG;
1488             /* fall through */
1489         case DISPATCH_METHOD:
1490             if(V_VT(&prop->var) != VT_DISPATCH) {
1491                 FIXME("invoke %s\n", debugstr_variant(&prop->var));
1492                 return E_NOTIMPL;
1493             }
1494
1495             return invoke_disp_value(This, V_DISPATCH(&prop->var), lcid, wFlags, pdp, pvarRes, pei, pspCaller);
1496         case DISPATCH_PROPERTYGET:
1497             if(prop->flags & DYNPROP_DELETED)
1498                 return DISP_E_UNKNOWNNAME;
1499             V_VT(pvarRes) = VT_EMPTY;
1500             return variant_copy(pvarRes, &prop->var);
1501         case DISPATCH_PROPERTYPUT:
1502             if(pdp->cArgs != 1 || (pdp->cNamedArgs == 1 && *pdp->rgdispidNamedArgs != DISPID_PROPERTYPUT)
1503                || pdp->cNamedArgs > 1) {
1504                 FIXME("invalid args\n");
1505                 return E_INVALIDARG;
1506             }
1507
1508             TRACE("put %s\n", debugstr_variant(pdp->rgvarg));
1509             VariantClear(&prop->var);
1510             hres = variant_copy(&prop->var, pdp->rgvarg);
1511             if(FAILED(hres))
1512                 return hres;
1513
1514             prop->flags &= ~DYNPROP_DELETED;
1515             return S_OK;
1516         default:
1517             FIXME("unhandled wFlags %x\n", wFlags);
1518             return E_NOTIMPL;
1519         }
1520     }
1521     case DISPEXPROP_BUILTIN:
1522         if(wFlags == DISPATCH_CONSTRUCT) {
1523             if(id == DISPID_VALUE) {
1524                 if(This->data->vtbl && This->data->vtbl->value) {
1525                     return This->data->vtbl->value(This, lcid, wFlags, pdp, pvarRes, pei, pspCaller);
1526                 }
1527                 FIXME("DISPATCH_CONSTRUCT flag but missing value function\n");
1528                 return E_FAIL;
1529             }
1530             FIXME("DISPATCH_CONSTRUCT flag without DISPID_VALUE\n");
1531             return E_FAIL;
1532         }
1533
1534         return invoke_builtin_prop(This, id, lcid, wFlags, pdp, pvarRes, pei, pspCaller);
1535     default:
1536         assert(0);
1537         return E_FAIL;
1538     }
1539 }
1540
1541 static HRESULT WINAPI DispatchEx_DeleteMemberByName(IDispatchEx *iface, BSTR bstrName, DWORD grfdex)
1542 {
1543     DispatchEx *This = impl_from_IDispatchEx(iface);
1544
1545     TRACE("(%p)->(%s %x)\n", This, debugstr_w(bstrName), grfdex);
1546
1547     /* Not implemented by IE */
1548     return E_NOTIMPL;
1549 }
1550
1551 static HRESULT WINAPI DispatchEx_DeleteMemberByDispID(IDispatchEx *iface, DISPID id)
1552 {
1553     DispatchEx *This = impl_from_IDispatchEx(iface);
1554
1555     TRACE("(%p)->(%x)\n", This, id);
1556
1557     /* Not implemented by IE */
1558     return E_NOTIMPL;
1559 }
1560
1561 static HRESULT WINAPI DispatchEx_GetMemberProperties(IDispatchEx *iface, DISPID id, DWORD grfdexFetch, DWORD *pgrfdex)
1562 {
1563     DispatchEx *This = impl_from_IDispatchEx(iface);
1564     FIXME("(%p)->(%x %x %p)\n", This, id, grfdexFetch, pgrfdex);
1565     return E_NOTIMPL;
1566 }
1567
1568 static HRESULT WINAPI DispatchEx_GetMemberName(IDispatchEx *iface, DISPID id, BSTR *pbstrName)
1569 {
1570     DispatchEx *This = impl_from_IDispatchEx(iface);
1571     dispex_data_t *data;
1572     func_info_t *func;
1573     HRESULT hres;
1574
1575     TRACE("(%p)->(%x %p)\n", This, id, pbstrName);
1576
1577     if(is_dynamic_dispid(id)) {
1578         DWORD idx = id - DISPID_DYNPROP_0;
1579
1580         if(!get_dynamic_data(This) || This->dynamic_data->prop_cnt <= idx)
1581             return DISP_E_UNKNOWNNAME;
1582
1583         *pbstrName = SysAllocString(This->dynamic_data->props[idx].name);
1584         if(!*pbstrName)
1585             return E_OUTOFMEMORY;
1586
1587         return S_OK;
1588     }
1589
1590     data = get_dispex_data(This);
1591     if(!data)
1592         return E_FAIL;
1593
1594     hres = get_builtin_func(data, id, &func);
1595     if(FAILED(hres))
1596         return hres;
1597
1598     *pbstrName = SysAllocString(func->name);
1599     if(!*pbstrName)
1600         return E_OUTOFMEMORY;
1601     return S_OK;
1602 }
1603
1604 static HRESULT next_dynamic_id(DispatchEx *dispex, DWORD idx, DISPID *ret_id)
1605 {
1606     while(idx < dispex->dynamic_data->prop_cnt && dispex->dynamic_data->props[idx].flags & DYNPROP_DELETED)
1607         idx++;
1608
1609     if(idx == dispex->dynamic_data->prop_cnt) {
1610         *ret_id = DISPID_STARTENUM;
1611         return S_FALSE;
1612     }
1613
1614     *ret_id = DISPID_DYNPROP_0+idx;
1615     return S_OK;
1616 }
1617
1618 static HRESULT WINAPI DispatchEx_GetNextDispID(IDispatchEx *iface, DWORD grfdex, DISPID id, DISPID *pid)
1619 {
1620     DispatchEx *This = impl_from_IDispatchEx(iface);
1621     dispex_data_t *data;
1622     func_info_t *func;
1623     HRESULT hres;
1624
1625     TRACE("(%p)->(%x %x %p)\n", This, grfdex, id, pid);
1626
1627     if(is_dynamic_dispid(id)) {
1628         DWORD idx = id - DISPID_DYNPROP_0;
1629
1630         if(!get_dynamic_data(This) || This->dynamic_data->prop_cnt <= idx)
1631             return DISP_E_UNKNOWNNAME;
1632
1633         return next_dynamic_id(This, idx+1, pid);
1634     }
1635
1636     data = get_dispex_data(This);
1637     if(!data)
1638         return E_FAIL;
1639
1640     if(id == DISPID_STARTENUM) {
1641         func = data->funcs;
1642     }else {
1643         hres = get_builtin_func(data, id, &func);
1644         if(FAILED(hres))
1645             return hres;
1646         func++;
1647     }
1648
1649     while(func < data->funcs+data->func_cnt) {
1650         /* FIXME: Skip hidden properties */
1651         if(func->func_disp_idx == -1) {
1652             *pid = func->id;
1653             return S_OK;
1654         }
1655         func++;
1656     }
1657
1658     if(get_dynamic_data(This) && This->dynamic_data->prop_cnt)
1659         return next_dynamic_id(This, 0, pid);
1660
1661     *pid = DISPID_STARTENUM;
1662     return S_FALSE;
1663 }
1664
1665 static HRESULT WINAPI DispatchEx_GetNameSpaceParent(IDispatchEx *iface, IUnknown **ppunk)
1666 {
1667     DispatchEx *This = impl_from_IDispatchEx(iface);
1668     FIXME("(%p)->(%p)\n", This, ppunk);
1669     return E_NOTIMPL;
1670 }
1671
1672 static IDispatchExVtbl DispatchExVtbl = {
1673     DispatchEx_QueryInterface,
1674     DispatchEx_AddRef,
1675     DispatchEx_Release,
1676     DispatchEx_GetTypeInfoCount,
1677     DispatchEx_GetTypeInfo,
1678     DispatchEx_GetIDsOfNames,
1679     DispatchEx_Invoke,
1680     DispatchEx_GetDispID,
1681     DispatchEx_InvokeEx,
1682     DispatchEx_DeleteMemberByName,
1683     DispatchEx_DeleteMemberByDispID,
1684     DispatchEx_GetMemberProperties,
1685     DispatchEx_GetMemberName,
1686     DispatchEx_GetNextDispID,
1687     DispatchEx_GetNameSpaceParent
1688 };
1689
1690 BOOL dispex_query_interface(DispatchEx *This, REFIID riid, void **ppv)
1691 {
1692     if(IsEqualGUID(&IID_IDispatch, riid))
1693         *ppv = &This->IDispatchEx_iface;
1694     else if(IsEqualGUID(&IID_IDispatchEx, riid))
1695         *ppv = &This->IDispatchEx_iface;
1696     else if(IsEqualGUID(&IID_IDispatchJS, riid))
1697         *ppv = NULL;
1698     else if(IsEqualGUID(&IID_UndocumentedScriptIface, riid))
1699         *ppv = NULL;
1700     else
1701         return FALSE;
1702
1703     if(*ppv)
1704         IUnknown_AddRef((IUnknown*)*ppv);
1705     return TRUE;
1706 }
1707
1708 void dispex_traverse(DispatchEx *This, nsCycleCollectionTraversalCallback *cb)
1709 {
1710     dynamic_prop_t *prop;
1711
1712     if(!This->dynamic_data)
1713         return;
1714
1715     for(prop = This->dynamic_data->props; prop < This->dynamic_data->props + This->dynamic_data->prop_cnt; prop++) {
1716         if(V_VT(&prop->var) == VT_DISPATCH)
1717             note_cc_edge((nsISupports*)V_DISPATCH(&prop->var), "dispex_data", cb);
1718     }
1719
1720     /* FIXME: Traverse func_disps */
1721 }
1722
1723 void dispex_unlink(DispatchEx *This)
1724 {
1725     dynamic_prop_t *prop;
1726
1727     if(!This->dynamic_data)
1728         return;
1729
1730     for(prop = This->dynamic_data->props; prop < This->dynamic_data->props + This->dynamic_data->prop_cnt; prop++) {
1731         if(V_VT(&prop->var) == VT_DISPATCH) {
1732             V_VT(&prop->var) = VT_EMPTY;
1733             IDispatch_Release(V_DISPATCH(&prop->var));
1734         }else {
1735             VariantClear(&prop->var);
1736         }
1737     }
1738 }
1739
1740 void release_dispex(DispatchEx *This)
1741 {
1742     dynamic_prop_t *prop;
1743
1744     if(!This->dynamic_data)
1745         return;
1746
1747     for(prop = This->dynamic_data->props; prop < This->dynamic_data->props + This->dynamic_data->prop_cnt; prop++) {
1748         VariantClear(&prop->var);
1749         heap_free(prop->name);
1750     }
1751
1752     heap_free(This->dynamic_data->props);
1753
1754     if(This->dynamic_data->func_disps) {
1755         func_obj_entry_t *iter;
1756
1757         for(iter = This->dynamic_data->func_disps; iter < This->dynamic_data->func_disps+This->data->data->func_disp_cnt; iter++) {
1758             if(iter->func_obj) {
1759                 iter->func_obj->obj = NULL;
1760                 IDispatchEx_Release(&iter->func_obj->dispex.IDispatchEx_iface);
1761             }
1762             VariantClear(&iter->val);
1763         }
1764
1765         heap_free(This->dynamic_data->func_disps);
1766     }
1767
1768     heap_free(This->dynamic_data);
1769 }
1770
1771 void init_dispex(DispatchEx *dispex, IUnknown *outer, dispex_static_data_t *data)
1772 {
1773     dispex->IDispatchEx_iface.lpVtbl = &DispatchExVtbl;
1774     dispex->outer = outer;
1775     dispex->data = data;
1776     dispex->dynamic_data = NULL;
1777 }