dlls/mshtml/dispex.c

   1 /*
   2  * Copyright 2008-2009 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include <stdarg.h>
  20 #include <assert.h>
  21
  22 #define COBJMACROS
  23 #define NONAMELESSUNION
  24
  25 #include "windef.h"
  26 #include "winbase.h"
  27 #include "winuser.h"
  28 #include "ole2.h"
  29
  30 #include "wine/debug.h"
  31
  32 #include "mshtml_private.h"
  33
  34 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  35
  36 #define MAX_ARGS 16
  37
  38 static CRITICAL_SECTION cs_dispex_static_data;
  39 static CRITICAL_SECTION_DEBUG cs_dispex_static_data_dbg =
  40 {
  41     0, 0, &cs_dispex_static_data,
  42     { &cs_dispex_static_data_dbg.ProcessLocksList, &cs_dispex_static_data_dbg.ProcessLocksList },
  43       0, 0, { (DWORD_PTR)(__FILE__ ": dispex_static_data") }
  44 };
  45 static CRITICAL_SECTION cs_dispex_static_data = { &cs_dispex_static_data_dbg, -1, 0, 0, 0, 0 };
  46
  47
  48 static const WCHAR objectW[] = {'[','o','b','j','e','c','t',']',0};
  49
  50 typedef struct {
  51     DISPID id;
  52     BSTR name;
  53     tid_t tid;
  54     SHORT call_vtbl_off;
  55     SHORT put_vtbl_off;
  56     SHORT get_vtbl_off;
  57     SHORT func_disp_idx;
  58     USHORT argc;
  59     VARTYPE prop_vt;
  60     VARTYPE *arg_types;
  61 } func_info_t;
  62
  63 struct dispex_data_t {
  64     DWORD func_cnt;
  65     func_info_t *funcs;
  66     func_info_t **name_table;
  67     DWORD func_disp_cnt;
  68
  69     struct list entry;
  70 };
  71
  72 typedef struct {
  73     VARIANT var;
  74     LPWSTR name;
  75     DWORD flags;
  76 } dynamic_prop_t;
  77
  78 #define DYNPROP_DELETED    0x01
  79
  80 typedef struct {
  81     DispatchEx dispex;
  82     IUnknown IUnknown_iface;
  83     LONG ref;
  84     DispatchEx *obj;
  85     func_info_t *info;
  86 } func_disp_t;
  87
  88 typedef struct {
  89     func_disp_t *func_obj;
  90     VARIANT val;
  91 } func_obj_entry_t;
  92
  93 struct dispex_dynamic_data_t {
  94     DWORD buf_size;
  95     DWORD prop_cnt;
  96     dynamic_prop_t *props;
  97     func_obj_entry_t *func_disps;
  98 };
  99
 100 #define DISPID_DYNPROP_0    0x50000000
 101 #define DISPID_DYNPROP_MAX  0x5fffffff
 102
 103 #define FDEX_VERSION_MASK 0xf0000000
 104
 105 static ITypeLib *typelib;
 106 static ITypeInfo *typeinfos[LAST_tid];
 107 static struct list dispex_data_list = LIST_INIT(dispex_data_list);
 108
 109 static REFIID tid_ids[] = {
 110 #define XIID(iface) &IID_ ## iface,
 111 #define XDIID(iface) &DIID_ ## iface,
 112 TID_LIST
 113 #undef XIID
 114 #undef XDIID
 115 };
 116
 117 static HRESULT load_typelib(void)
 118 {
 119     HRESULT hres;
 120     ITypeLib *tl;
 121
 122     hres = LoadRegTypeLib(&LIBID_MSHTML, 4, 0, LOCALE_SYSTEM_DEFAULT, &tl);
 123     if(FAILED(hres)) {
 124         ERR("LoadRegTypeLib failed: %08x\n", hres);
 125         return hres;
 126     }
 127
 128     if(InterlockedCompareExchangePointer((void**)&typelib, tl, NULL))
 129         ITypeLib_Release(tl);
 130     return hres;
 131 }
 132
 133 static HRESULT get_typeinfo(tid_t tid, ITypeInfo **typeinfo)
 134 {
 135     HRESULT hres;
 136
 137     if (!typelib)
 138         hres = load_typelib();
 139     if (!typelib)
 140         return hres;
 141
 142     if(!typeinfos[tid]) {
 143         ITypeInfo *ti;
 144
 145         hres = ITypeLib_GetTypeInfoOfGuid(typelib, tid_ids[tid], &ti);
 146         if(FAILED(hres)) {
 147             ERR("GetTypeInfoOfGuid(%s) failed: %08x\n", debugstr_mshtml_guid(tid_ids[tid]), hres);
 148             return hres;
 149         }
 150
 151         if(InterlockedCompareExchangePointer((void**)(typeinfos+tid), ti, NULL))
 152             ITypeInfo_Release(ti);
 153     }
 154
 155     *typeinfo = typeinfos[tid];
 156     return S_OK;
 157 }
 158
 159 void release_typelib(void)
 160 {
 161     dispex_data_t *iter;
 162     unsigned i;
 163
 164     while(!list_empty(&dispex_data_list)) {
 165         iter = LIST_ENTRY(list_head(&dispex_data_list), dispex_data_t, entry);
 166         list_remove(&iter->entry);
 167
 168         for(i=0; i < iter->func_cnt; i++)
 169             SysFreeString(iter->funcs[i].name);
 170
 171         heap_free(iter->funcs);
 172         heap_free(iter->name_table);
 173         heap_free(iter);
 174     }
 175
 176     if(!typelib)
 177         return;
 178
 179     for(i=0; i < sizeof(typeinfos)/sizeof(*typeinfos); i++)
 180         if(typeinfos[i])
 181             ITypeInfo_Release(typeinfos[i]);
 182
 183     ITypeLib_Release(typelib);
 184     DeleteCriticalSection(&cs_dispex_static_data);
 185 }
 186
 187 HRESULT get_htmldoc_classinfo(ITypeInfo **typeinfo)
 188 {
 189     HRESULT hres;
 190
 191     if (!typelib)
 192         hres = load_typelib();
 193     if (!typelib)
 194         return hres;
 195
 196     hres = ITypeLib_GetTypeInfoOfGuid(typelib, &CLSID_HTMLDocument, typeinfo);
 197     if(FAILED(hres))
 198         ERR("GetTypeInfoOfGuid failed: %08x\n", hres);
 199     return hres;
 200 }
 201
 202 /* Not all argument types are supported yet */
 203 #define BUILTIN_ARG_TYPES_SWITCH                        \
 204     CASE_VT(VT_I2, INT16, V_I2);                        \
 205     CASE_VT(VT_I4, INT32, V_I4);                        \
 206     CASE_VT(VT_R4, float, V_R4);                        \
 207     CASE_VT(VT_BSTR, BSTR, V_BSTR);                     \
 208     CASE_VT(VT_BOOL, VARIANT_BOOL, V_BOOL)
 209
 210 /* List all types used by IDispatchEx-based properties */
 211 #define BUILTIN_TYPES_SWITCH                            \
 212     BUILTIN_ARG_TYPES_SWITCH;                           \
 213     CASE_VT(VT_VARIANT, VARIANT, *);                    \
 214     CASE_VT(VT_PTR, void*, V_BYREF);                    \
 215     CASE_VT(VT_UNKNOWN, IUnknown*, V_UNKNOWN);          \
 216     CASE_VT(VT_DISPATCH, IDispatch*, V_DISPATCH)
 217
 218 static BOOL is_arg_type_supported(VARTYPE vt)
 219 {
 220     switch(vt) {
 221 #define CASE_VT(x,a,b) case x: return TRUE
 222     BUILTIN_ARG_TYPES_SWITCH;
 223 #undef CASE_VT
 224     }
 225     return FALSE;
 226 }
 227
 228 static void add_func_info(dispex_data_t *data, DWORD *size, tid_t tid, const FUNCDESC *desc, ITypeInfo *dti)
 229 {
 230     func_info_t *info;
 231     HRESULT hres;
 232
 233     for(info = data->funcs; info < data->funcs+data->func_cnt; info++) {
 234         if(info->id == desc->memid) {
 235             if(info->tid != tid)
 236                 return; /* Duplicated in other interface */
 237             break;
 238         }
 239     }
 240
 241     if(info == data->funcs+data->func_cnt) {
 242         if(data->func_cnt == *size)
 243             data->funcs = heap_realloc_zero(data->funcs, (*size <<= 1)*sizeof(func_info_t));
 244
 245         info = data->funcs+data->func_cnt;
 246         hres = ITypeInfo_GetDocumentation(dti, desc->memid, &info->name, NULL, NULL, NULL);
 247         if(FAILED(hres))
 248             return;
 249
 250         data->func_cnt++;
 251
 252         info->id = desc->memid;
 253         info->tid = tid;
 254         info->func_disp_idx = -1;
 255         info->prop_vt = VT_EMPTY;
 256     }
 257
 258     if(desc->invkind & DISPATCH_METHOD) {
 259         unsigned i;
 260
 261         info->func_disp_idx = data->func_disp_cnt++;
 262         info->argc = desc->cParams;
 263
 264         assert(info->argc < MAX_ARGS);
 265         assert(desc->funckind == FUNC_DISPATCH);
 266
 267         info->arg_types = heap_alloc(sizeof(*info->arg_types) * info->argc);
 268         if(!info->arg_types)
 269             return; /* FIXME: real error instead of fallback */
 270
 271         for(i=0; i < info->argc; i++)
 272             info->arg_types[i] = desc->lprgelemdescParam[i].tdesc.vt;
 273
 274         info->prop_vt = desc->elemdescFunc.tdesc.vt;
 275         if(info->prop_vt != VT_VOID && !is_arg_type_supported(info->prop_vt)) {
 276             TRACE("%s: return type %d\n", debugstr_w(info->name), info->prop_vt);
 277             return; /* Fallback to ITypeInfo::Invoke */
 278         }
 279
 280         if(desc->cParamsOpt) {
 281             TRACE("%s: optional params\n", debugstr_w(info->name));
 282             return; /* Fallback to ITypeInfo::Invoke */
 283         }
 284
 285         for(i=0; i < info->argc; i++) {
 286             if(!is_arg_type_supported(info->arg_types[i])) {
 287                 return; /* Fallback to ITypeInfo for unsupported arg types */
 288             }
 289
 290             if(desc->lprgelemdescParam[i].u.paramdesc.wParamFlags & PARAMFLAG_FHASDEFAULT) {
 291                 TRACE("%s param %d: default value\n", debugstr_w(info->name), i);
 292                 return; /* Fallback to ITypeInfo::Invoke */
 293             }
 294         }
 295
 296         assert(info->argc <= MAX_ARGS);
 297         assert(desc->callconv == CC_STDCALL);
 298
 299         info->call_vtbl_off = desc->oVft/sizeof(void*);
 300     }else if(desc->invkind & (DISPATCH_PROPERTYPUT|DISPATCH_PROPERTYGET)) {
 301         VARTYPE vt = VT_EMPTY;
 302
 303         if(desc->invkind & DISPATCH_PROPERTYGET) {
 304             vt = desc->elemdescFunc.tdesc.vt;
 305             info->get_vtbl_off = desc->oVft/sizeof(void*);
 306         }
 307         if(desc->invkind & DISPATCH_PROPERTYPUT) {
 308             assert(desc->cParams == 1);
 309             vt = desc->lprgelemdescParam->tdesc.vt;
 310             info->put_vtbl_off = desc->oVft/sizeof(void*);
 311         }
 312
 313         assert(info->prop_vt == VT_EMPTY || vt == info->prop_vt);
 314         info->prop_vt = vt;
 315     }
 316 }
 317
 318 static int dispid_cmp(const void *p1, const void *p2)
 319 {
 320     return ((const func_info_t*)p1)->id - ((const func_info_t*)p2)->id;
 321 }
 322
 323 static int func_name_cmp(const void *p1, const void *p2)
 324 {
 325     return strcmpiW((*(func_info_t* const*)p1)->name, (*(func_info_t* const*)p2)->name);
 326 }
 327
 328 static dispex_data_t *preprocess_dispex_data(DispatchEx *This)
 329 {
 330     const tid_t *tid = This->data->iface_tids;
 331     FUNCDESC *funcdesc;
 332     dispex_data_t *data;
 333     DWORD size = 16, i;
 334     ITypeInfo *ti, *dti;
 335     HRESULT hres;
 336
 337     TRACE("(%p)\n", This);
 338
 339     if(This->data->disp_tid) {
 340         hres = get_typeinfo(This->data->disp_tid, &dti);
 341         if(FAILED(hres)) {
 342             ERR("Could not get disp type info: %08x\n", hres);
 343             return NULL;
 344         }
 345     }
 346
 347     data = heap_alloc(sizeof(dispex_data_t));
 348     if (!data) {
 349         ERR("Out of memory\n");
 350         return NULL;
 351     }
 352     data->func_cnt = 0;
 353     data->func_disp_cnt = 0;
 354     data->funcs = heap_alloc_zero(size*sizeof(func_info_t));
 355     if (!data->funcs) {
 356         heap_free (data);
 357         ERR("Out of memory\n");
 358         return NULL;
 359     }
 360     list_add_tail(&dispex_data_list, &data->entry);
 361
 362     while(*tid) {
 363         hres = get_typeinfo(*tid, &ti);
 364         if(FAILED(hres))
 365             break;
 366
 367         i=7;
 368         while(1) {
 369             hres = ITypeInfo_GetFuncDesc(ti, i++, &funcdesc);
 370             if(FAILED(hres))
 371                 break;
 372
 373             add_func_info(data, &size, *tid, funcdesc, dti);
 374             ITypeInfo_ReleaseFuncDesc(ti, funcdesc);
 375         }
 376
 377         tid++;
 378     }
 379
 380     if(!data->func_cnt) {
 381         heap_free(data->funcs);
 382         data->name_table = NULL;
 383         data->funcs = NULL;
 384         return data;
 385     }
 386
 387
 388     data->funcs = heap_realloc(data->funcs, data->func_cnt * sizeof(func_info_t));
 389     qsort(data->funcs, data->func_cnt, sizeof(func_info_t), dispid_cmp);
 390
 391     data->name_table = heap_alloc(data->func_cnt * sizeof(func_info_t*));
 392     for(i=0; i < data->func_cnt; i++)
 393         data->name_table[i] = data->funcs+i;
 394     qsort(data->name_table, data->func_cnt, sizeof(func_info_t*), func_name_cmp);
 395
 396     return data;
 397 }
 398
 399 static int id_cmp(const void *p1, const void *p2)
 400 {
 401     return *(const DISPID*)p1 - *(const DISPID*)p2;
 402 }
 403
 404 HRESULT get_dispids(tid_t tid, DWORD *ret_size, DISPID **ret)
 405 {
 406     unsigned i, func_cnt;
 407     FUNCDESC *funcdesc;
 408     ITypeInfo *ti;
 409     TYPEATTR *attr;
 410     DISPID *ids;
 411     HRESULT hres;
 412
 413     hres = get_typeinfo(tid, &ti);
 414     if(FAILED(hres))
 415         return hres;
 416
 417     hres = ITypeInfo_GetTypeAttr(ti, &attr);
 418     if(FAILED(hres)) {
 419         ITypeInfo_Release(ti);
 420         return hres;
 421     }
 422
 423     func_cnt = attr->cFuncs;
 424     ITypeInfo_ReleaseTypeAttr(ti, attr);
 425
 426     ids = heap_alloc(func_cnt*sizeof(DISPID));
 427     if(!ids) {
 428         ITypeInfo_Release(ti);
 429         return E_OUTOFMEMORY;
 430     }
 431
 432     for(i=0; i < func_cnt; i++) {
 433         hres = ITypeInfo_GetFuncDesc(ti, i, &funcdesc);
 434         if(FAILED(hres))
 435             break;
 436
 437         ids[i] = funcdesc->memid;
 438         ITypeInfo_ReleaseFuncDesc(ti, funcdesc);
 439     }
 440
 441     ITypeInfo_Release(ti);
 442     if(FAILED(hres)) {
 443         heap_free(ids);
 444         return hres;
 445     }
 446
 447     qsort(ids, func_cnt, sizeof(DISPID), id_cmp);
 448
 449     *ret_size = func_cnt;
 450     *ret = ids;
 451     return S_OK;
 452 }
 453
 454 static dispex_data_t *get_dispex_data(DispatchEx *This)
 455 {
 456     if(This->data->data)
 457         return This->data->data;
 458
 459     EnterCriticalSection(&cs_dispex_static_data);
 460
 461     if(!This->data->data)
 462         This->data->data = preprocess_dispex_data(This);
 463
 464     LeaveCriticalSection(&cs_dispex_static_data);
 465
 466     return This->data->data;
 467 }
 468
 469 static inline BOOL is_custom_dispid(DISPID id)
 470 {
 471     return MSHTML_DISPID_CUSTOM_MIN <= id && id <= MSHTML_DISPID_CUSTOM_MAX;
 472 }
 473
 474 static inline BOOL is_dynamic_dispid(DISPID id)
 475 {
 476     return DISPID_DYNPROP_0 <= id && id <= DISPID_DYNPROP_MAX;
 477 }
 478
 479 dispex_prop_type_t get_dispid_type(DISPID id)
 480 {
 481     if(is_dynamic_dispid(id))
 482         return DISPEXPROP_DYNAMIC;
 483     if(is_custom_dispid(id))
 484         return DISPEXPROP_CUSTOM;
 485     return DISPEXPROP_BUILTIN;
 486 }
 487
 488 static HRESULT variant_copy(VARIANT *dest, VARIANT *src)
 489 {
 490     if(V_VT(src) == VT_BSTR && !V_BSTR(src)) {
 491         V_VT(dest) = VT_BSTR;
 492         V_BSTR(dest) = NULL;
 493         return S_OK;
 494     }
 495
 496     return VariantCopy(dest, src);
 497 }
 498
 499 static inline dispex_dynamic_data_t *get_dynamic_data(DispatchEx *This)
 500 {
 501     if(This->dynamic_data)
 502         return This->dynamic_data;
 503
 504     This->dynamic_data = heap_alloc_zero(sizeof(dispex_dynamic_data_t));
 505     if(!This->dynamic_data)
 506         return NULL;
 507
 508     if(This->data->vtbl && This->data->vtbl->populate_props)
 509         This->data->vtbl->populate_props(This);
 510
 511     return This->dynamic_data;
 512 }
 513
 514 static HRESULT get_dynamic_prop(DispatchEx *This, const WCHAR *name, DWORD flags, dynamic_prop_t **ret)
 515 {
 516     const BOOL alloc = flags & fdexNameEnsure;
 517     dispex_dynamic_data_t *data;
 518     dynamic_prop_t *prop;
 519
 520     data = get_dynamic_data(This);
 521     if(!data)
 522         return E_OUTOFMEMORY;
 523
 524     for(prop = data->props; prop < data->props+data->prop_cnt; prop++) {
 525         if(flags & fdexNameCaseInsensitive ? !strcmpiW(prop->name, name) : !strcmpW(prop->name, name)) {
 526             if(prop->flags & DYNPROP_DELETED) {
 527                 if(!alloc)
 528                     return DISP_E_UNKNOWNNAME;
 529                 prop->flags &= ~DYNPROP_DELETED;
 530             }
 531             *ret = prop;
 532             return S_OK;
 533         }
 534     }
 535
 536     if(!alloc)
 537         return DISP_E_UNKNOWNNAME;
 538
 539     TRACE("creating dynamic prop %s\n", debugstr_w(name));
 540
 541     if(!data->buf_size) {
 542         data->props = heap_alloc(sizeof(dynamic_prop_t)*4);
 543         if(!data->props)
 544             return E_OUTOFMEMORY;
 545         data->buf_size = 4;
 546     }else if(data->buf_size == data->prop_cnt) {
 547         dynamic_prop_t *new_props;
 548
 549         new_props = heap_realloc(data->props, sizeof(dynamic_prop_t)*(data->buf_size<<1));
 550         if(!new_props)
 551             return E_OUTOFMEMORY;
 552
 553         data->props = new_props;
 554         data->buf_size <<= 1;
 555     }
 556
 557     prop = data->props + data->prop_cnt;
 558
 559     prop->name = heap_strdupW(name);
 560     if(!prop->name)
 561         return E_OUTOFMEMORY;
 562
 563     VariantInit(&prop->var);
 564     prop->flags = 0;
 565     data->prop_cnt++;
 566     *ret = prop;
 567     return S_OK;
 568 }
 569
 570 HRESULT dispex_get_dprop_ref(DispatchEx *This, const WCHAR *name, BOOL alloc, VARIANT **ret)
 571 {
 572     dynamic_prop_t *prop;
 573     HRESULT hres;
 574
 575     hres = get_dynamic_prop(This, name, alloc ? fdexNameEnsure : 0, &prop);
 576     if(FAILED(hres))
 577         return hres;
 578
 579     *ret = &prop->var;
 580     return S_OK;
 581 }
 582
 583 HRESULT dispex_get_dynid(DispatchEx *This, const WCHAR *name, DISPID *id)
 584 {
 585     dynamic_prop_t *prop;
 586     HRESULT hres;
 587
 588     hres = get_dynamic_prop(This, name, fdexNameEnsure, &prop);
 589     if(FAILED(hres))
 590         return hres;
 591
 592     *id = DISPID_DYNPROP_0 + (prop - This->dynamic_data->props);
 593     return S_OK;
 594 }
 595
 596 static HRESULT dispex_value(DispatchEx *This, LCID lcid, WORD flags, DISPPARAMS *params,
 597         VARIANT *res, EXCEPINFO *ei, IServiceProvider *caller)
 598 {
 599     if(This->data->vtbl && This->data->vtbl->value)
 600         return This->data->vtbl->value(This, lcid, flags, params, res, ei, caller);
 601
 602     switch(flags) {
 603     case DISPATCH_PROPERTYGET:
 604         V_VT(res) = VT_BSTR;
 605         V_BSTR(res) = SysAllocString(objectW);
 606         if(!V_BSTR(res))
 607             return E_OUTOFMEMORY;
 608         break;
 609     default:
 610         FIXME("Unimplemented flags %x\n", flags);
 611         return E_NOTIMPL;
 612     }
 613
 614     return S_OK;
 615 }
 616
 617 static HRESULT typeinfo_invoke(DispatchEx *This, func_info_t *func, WORD flags, DISPPARAMS *dp, VARIANT *res,
 618         EXCEPINFO *ei)
 619 {
 620     DISPPARAMS params = {dp->rgvarg+dp->cNamedArgs, NULL, dp->cArgs-dp->cNamedArgs, 0};
 621     ITypeInfo *ti;
 622     IUnknown *unk;
 623     UINT argerr=0;
 624     HRESULT hres;
 625
 626     hres = get_typeinfo(func->tid, &ti);
 627     if(FAILED(hres)) {
 628         ERR("Could not get type info: %08x\n", hres);
 629         return hres;
 630     }
 631
 632     hres = IUnknown_QueryInterface(This->outer, tid_ids[func->tid], (void**)&unk);
 633     if(FAILED(hres)) {
 634         ERR("Could not get iface %s: %08x\n", debugstr_mshtml_guid(tid_ids[func->tid]), hres);
 635         return E_FAIL;
 636     }
 637
 638     hres = ITypeInfo_Invoke(ti, unk, func->id, flags, &params, res, ei, &argerr);
 639
 640     IUnknown_Release(unk);
 641     return hres;
 642 }
 643
 644 static inline func_disp_t *impl_from_IUnknown(IUnknown *iface)
 645 {
 646     return CONTAINING_RECORD(iface, func_disp_t, IUnknown_iface);
 647 }
 648
 649 static HRESULT WINAPI Function_QueryInterface(IUnknown *iface, REFIID riid, void **ppv)
 650 {
 651     func_disp_t *This = impl_from_IUnknown(iface);
 652
 653     TRACE("(%p)->(%s %p)\n", This, debugstr_mshtml_guid(riid), ppv);
 654
 655     if(IsEqualGUID(&IID_IUnknown, riid)) {
 656         *ppv = &This->IUnknown_iface;
 657     }else if(dispex_query_interface(&This->dispex, riid, ppv)) {
 658         return *ppv ? S_OK : E_NOINTERFACE;
 659     }else {
 660         *ppv = NULL;
 661         return E_NOINTERFACE;
 662     }
 663
 664     IUnknown_AddRef((IUnknown*)*ppv);
 665     return S_OK;
 666 }
 667
 668 static ULONG WINAPI Function_AddRef(IUnknown *iface)
 669 {
 670     func_disp_t *This = impl_from_IUnknown(iface);
 671     LONG ref = InterlockedIncrement(&This->ref);
 672
 673     TRACE("(%p) ref=%d\n", This, ref);
 674
 675     return ref;
 676 }
 677
 678 static ULONG WINAPI Function_Release(IUnknown *iface)
 679 {
 680     func_disp_t *This = impl_from_IUnknown(iface);
 681     LONG ref = InterlockedDecrement(&This->ref);
 682
 683     TRACE("(%p) ref=%d\n", This, ref);
 684
 685     if(!ref) {
 686         assert(!This->obj);
 687         release_dispex(&This->dispex);
 688         heap_free(This);
 689     }
 690
 691     return ref;
 692 }
 693
 694 static const IUnknownVtbl FunctionUnkVtbl = {
 695     Function_QueryInterface,
 696     Function_AddRef,
 697     Function_Release
 698 };
 699
 700 static inline func_disp_t *impl_from_DispatchEx(DispatchEx *iface)
 701 {
 702     return CONTAINING_RECORD(iface, func_disp_t, dispex);
 703 }
 704
 705 static HRESULT function_value(DispatchEx *dispex, LCID lcid, WORD flags, DISPPARAMS *params,
 706         VARIANT *res, EXCEPINFO *ei, IServiceProvider *caller)
 707 {
 708     func_disp_t *This = impl_from_DispatchEx(dispex);
 709     HRESULT hres;
 710
 711     switch(flags) {
 712     case DISPATCH_METHOD|DISPATCH_PROPERTYGET:
 713         if(!res)
 714             return E_INVALIDARG;
 715         /* fall through */
 716     case DISPATCH_METHOD:
 717         if(!This->obj)
 718             return E_UNEXPECTED;
 719         hres = typeinfo_invoke(This->obj, This->info, flags, params, res, ei);
 720         break;
 721     case DISPATCH_PROPERTYGET: {
 722         unsigned name_len;
 723         WCHAR *ptr;
 724         BSTR str;
 725
 726         static const WCHAR func_prefixW[] =
 727             {'\n','f','u','n','c','t','i','o','n',' '};
 728         static const WCHAR func_suffixW[] =
 729             {'(',')',' ','{','\n',' ',' ',' ',' ','[','n','a','t','i','v','e',' ','c','o','d','e',']','\n','}','\n'};
 730
 731         /* FIXME: This probably should be more generic. Also we should try to get IID_IActiveScriptSite and SID_GetCaller. */
 732         if(!caller)
 733             return E_ACCESSDENIED;
 734
 735         name_len = SysStringLen(This->info->name);
 736         ptr = str = SysAllocStringLen(NULL, name_len + (sizeof(func_prefixW)+sizeof(func_suffixW))/sizeof(WCHAR));
 737         if(!str)
 738             return E_OUTOFMEMORY;
 739
 740         memcpy(ptr, func_prefixW, sizeof(func_prefixW));
 741         ptr += sizeof(func_prefixW)/sizeof(WCHAR);
 742
 743         memcpy(ptr, This->info->name, name_len*sizeof(WCHAR));
 744         ptr += name_len;
 745
 746         memcpy(ptr, func_suffixW, sizeof(func_suffixW));
 747
 748         V_VT(res) = VT_BSTR;
 749         V_BSTR(res) = str;
 750         return S_OK;
 751     }
 752     default:
 753         FIXME("Unimplemented flags %x\n", flags);
 754         hres = E_NOTIMPL;
 755     }
 756
 757     return hres;
 758 }
 759
 760 static const dispex_static_data_vtbl_t function_dispex_vtbl = {
 761     function_value,
 762     NULL,
 763     NULL,
 764     NULL
 765 };
 766
 767 static const tid_t function_iface_tids[] = {0};
 768
 769 static dispex_static_data_t function_dispex = {
 770     &function_dispex_vtbl,
 771     NULL_tid,
 772     NULL,
 773     function_iface_tids
 774 };
 775
 776 static func_disp_t *create_func_disp(DispatchEx *obj, func_info_t *info)
 777 {
 778     func_disp_t *ret;
 779
 780     ret = heap_alloc_zero(sizeof(func_disp_t));
 781     if(!ret)
 782         return NULL;
 783
 784     ret->IUnknown_iface.lpVtbl = &FunctionUnkVtbl;
 785     init_dispex(&ret->dispex, &ret->IUnknown_iface,  &function_dispex);
 786     ret->ref = 1;
 787     ret->obj = obj;
 788     ret->info = info;
 789
 790     return ret;
 791 }
 792
 793 static HRESULT invoke_disp_value(DispatchEx *This, IDispatch *func_disp, LCID lcid, WORD flags, DISPPARAMS *dp,
 794         VARIANT *res, EXCEPINFO *ei, IServiceProvider *caller)
 795 {
 796     DISPID named_arg = DISPID_THIS;
 797     DISPPARAMS new_dp = {NULL, &named_arg, 0, 1};
 798     IDispatchEx *dispex;
 799     HRESULT hres;
 800
 801     if(dp->cNamedArgs) {
 802         FIXME("named args not supported\n");
 803         return E_NOTIMPL;
 804     }
 805
 806     new_dp.rgvarg = heap_alloc((dp->cArgs+1)*sizeof(VARIANTARG));
 807     if(!new_dp.rgvarg)
 808         return E_OUTOFMEMORY;
 809
 810     new_dp.cArgs = dp->cArgs+1;
 811     memcpy(new_dp.rgvarg+1, dp->rgvarg, dp->cArgs*sizeof(VARIANTARG));
 812
 813     V_VT(new_dp.rgvarg) = VT_DISPATCH;
 814     V_DISPATCH(new_dp.rgvarg) = (IDispatch*)&This->IDispatchEx_iface;
 815
 816     hres = IDispatch_QueryInterface(func_disp, &IID_IDispatchEx, (void**)&dispex);
 817     TRACE(">>>\n");
 818     if(SUCCEEDED(hres)) {
 819         hres = IDispatchEx_InvokeEx(dispex, DISPID_VALUE, lcid, flags, &new_dp, res, ei, caller);
 820         IDispatchEx_Release(dispex);
 821     }else {
 822         ULONG err = 0;
 823         hres = IDispatch_Invoke(func_disp, DISPID_VALUE, &IID_NULL, lcid, flags, &new_dp, res, ei, &err);
 824     }
 825     if(SUCCEEDED(hres))
 826         TRACE("<<< %s\n", debugstr_variant(res));
 827     else
 828         WARN("<<< %08x\n", hres);
 829
 830     heap_free(new_dp.rgvarg);
 831     return hres;
 832 }
 833
 834 static HRESULT get_func_obj_entry(DispatchEx *This, func_info_t *func, func_obj_entry_t **ret)
 835 {
 836     dispex_dynamic_data_t *dynamic_data;
 837     func_obj_entry_t *entry;
 838
 839     dynamic_data = get_dynamic_data(This);
 840     if(!dynamic_data)
 841         return E_OUTOFMEMORY;
 842
 843     if(!dynamic_data->func_disps) {
 844         dynamic_data->func_disps = heap_alloc_zero(This->data->data->func_disp_cnt * sizeof(*dynamic_data->func_disps));
 845         if(!dynamic_data->func_disps)
 846             return E_OUTOFMEMORY;
 847     }
 848
 849     entry = dynamic_data->func_disps + func->func_disp_idx;
 850     if(!entry->func_obj) {
 851         entry->func_obj = create_func_disp(This, func);
 852         if(!entry->func_obj)
 853             return E_OUTOFMEMORY;
 854
 855         IDispatchEx_AddRef(&entry->func_obj->dispex.IDispatchEx_iface);
 856         V_VT(&entry->val) = VT_DISPATCH;
 857         V_DISPATCH(&entry->val) = (IDispatch*)&entry->func_obj->dispex.IDispatchEx_iface;
 858     }
 859
 860     *ret = entry;
 861     return S_OK;
 862 }
 863
 864 static HRESULT get_builtin_func(dispex_data_t *data, DISPID id, func_info_t **ret)
 865 {
 866     int min, max, n;
 867
 868     min = 0;
 869     max = data->func_cnt-1;
 870
 871     while(min <= max) {
 872         n = (min+max)/2;
 873
 874         if(data->funcs[n].id == id) {
 875             *ret = data->funcs+n;
 876             return S_OK;
 877         }
 878
 879         if(data->funcs[n].id < id)
 880             min = n+1;
 881         else
 882             max = n-1;
 883     }
 884
 885     WARN("invalid id %x\n", id);
 886     return DISP_E_UNKNOWNNAME;
 887 }
 888
 889 static HRESULT get_builtin_id(DispatchEx *This, BSTR name, DWORD grfdex, DISPID *ret)
 890 {
 891     dispex_data_t *data;
 892     int min, max, n, c;
 893
 894     data = get_dispex_data(This);
 895     if(!data)
 896         return E_FAIL;
 897
 898     min = 0;
 899     max = data->func_cnt-1;
 900
 901     while(min <= max) {
 902         n = (min+max)/2;
 903
 904         c = strcmpiW(data->name_table[n]->name, name);
 905         if(!c) {
 906             if((grfdex & fdexNameCaseSensitive) && strcmpW(data->name_table[n]->name, name))
 907                 break;
 908
 909             *ret = data->name_table[n]->id;
 910             return S_OK;
 911         }
 912
 913         if(c > 0)
 914             max = n-1;
 915         else
 916             min = n+1;
 917     }
 918
 919     if(This->data->vtbl && This->data->vtbl->get_dispid) {
 920         HRESULT hres;
 921
 922         hres = This->data->vtbl->get_dispid(This, name, grfdex, ret);
 923         if(hres != DISP_E_UNKNOWNNAME)
 924             return hres;
 925     }
 926
 927     return DISP_E_UNKNOWNNAME;
 928 }
 929
 930 static HRESULT change_type(VARIANT *dst, VARIANT *src, VARTYPE vt, IServiceProvider *caller)
 931 {
 932     V_VT(dst) = VT_EMPTY;
 933
 934     if(caller) {
 935         IVariantChangeType *change_type = NULL;
 936         HRESULT hres;
 937
 938         hres = IServiceProvider_QueryService(caller, &SID_VariantConversion, &IID_IVariantChangeType, (void**)&change_type);
 939         if(SUCCEEDED(hres)) {
 940             hres = IVariantChangeType_ChangeType(change_type, dst, src, LOCALE_NEUTRAL, vt);
 941             IVariantChangeType_Release(change_type);
 942             return hres;
 943         }
 944     }
 945
 946     switch(vt) {
 947     case VT_BOOL:
 948         if(V_VT(src) == VT_BSTR) {
 949             V_VT(dst) = VT_BOOL;
 950             V_BOOL(dst) = V_BSTR(src) && *V_BSTR(src) ? VARIANT_TRUE : VARIANT_FALSE;
 951             return S_OK;
 952         }
 953         break;
 954     }
 955
 956     return VariantChangeType(dst, src, 0, vt);
 957 }
 958
 959 static HRESULT builtin_propget(DispatchEx *This, func_info_t *func, DISPPARAMS *dp, VARIANT *res)
 960 {
 961     IUnknown *iface;
 962     HRESULT hres;
 963
 964     if(dp && dp->cArgs) {
 965         FIXME("cArgs %d\n", dp->cArgs);
 966         return E_NOTIMPL;
 967     }
 968
 969     assert(func->get_vtbl_off);
 970
 971     hres = IUnknown_QueryInterface(This->outer, tid_ids[func->tid], (void**)&iface);
 972     if(SUCCEEDED(hres)) {
 973         switch(func->prop_vt) {
 974 #define CASE_VT(vt,type,access) \
 975         case vt: { \
 976             type val; \
 977             hres = ((HRESULT (WINAPI*)(IUnknown*,type*))((void**)iface->lpVtbl)[func->get_vtbl_off])(iface,&val); \
 978             if(SUCCEEDED(hres)) \
 979                 access(res) = val; \
 980             } \
 981             break
 982         BUILTIN_TYPES_SWITCH;
 983 #undef CASE_VT
 984         default:
 985             FIXME("Unhandled vt %d\n", func->prop_vt);
 986             hres = E_NOTIMPL;
 987         }
 988         IUnknown_Release(iface);
 989     }
 990
 991     if(FAILED(hres))
 992         return hres;
 993
 994     if(func->prop_vt != VT_VARIANT)
 995         V_VT(res) = func->prop_vt == VT_PTR ? VT_DISPATCH : func->prop_vt;
 996     return S_OK;
 997 }
 998
 999 static HRESULT builtin_propput(DispatchEx *This, func_info_t *func, DISPPARAMS *dp, IServiceProvider *caller)
1000 {
1001     VARIANT *v, tmpv;
1002     IUnknown *iface;
1003     HRESULT hres;
1004
1005     if(dp->cArgs != 1 || (dp->cNamedArgs == 1 && *dp->rgdispidNamedArgs != DISPID_PROPERTYPUT)
1006             || dp->cNamedArgs > 1) {
1007         FIXME("invalid args\n");
1008         return E_INVALIDARG;
1009     }
1010
1011     if(!func->put_vtbl_off) {
1012         FIXME("No setter\n");
1013         return E_FAIL;
1014     }
1015
1016     v = dp->rgvarg;
1017     if(func->prop_vt != VT_VARIANT && V_VT(v) != func->prop_vt) {
1018         hres = change_type(&tmpv, v, func->prop_vt, caller);
1019         if(FAILED(hres))
1020             return hres;
1021         v = &tmpv;
1022     }
1023
1024     hres = IUnknown_QueryInterface(This->outer, tid_ids[func->tid], (void**)&iface);
1025     if(SUCCEEDED(hres)) {
1026         switch(func->prop_vt) {
1027 #define CASE_VT(vt,type,access) \
1028         case vt: \
1029             hres = ((HRESULT (WINAPI*)(IUnknown*,type))((void**)iface->lpVtbl)[func->put_vtbl_off])(iface,access(v)); \
1030             break
1031         BUILTIN_TYPES_SWITCH;
1032 #undef CASE_VT
1033         default:
1034             FIXME("Unimplemented vt %d\n", func->prop_vt);
1035             hres = E_NOTIMPL;
1036         }
1037
1038         IUnknown_Release(iface);
1039     }
1040
1041     if(v == &tmpv)
1042         VariantClear(v);
1043     return hres;
1044 }
1045
1046 static HRESULT invoke_builtin_function(DispatchEx *This, func_info_t *func, DISPPARAMS *dp, VARIANT *res, IServiceProvider *caller)
1047 {
1048     VARIANT arg_buf[MAX_ARGS], *arg_ptrs[MAX_ARGS], *arg, retv, ret_ref, vhres;
1049     unsigned i, nconv = 0;
1050     IUnknown *iface;
1051     HRESULT hres;
1052
1053     if(dp->cNamedArgs) {
1054         FIXME("Named arguments not supported\n");
1055         return E_NOTIMPL;
1056     }
1057
1058     if(dp->cArgs != func->argc) {
1059         FIXME("Invalid argument count (expected %u, got %u)\n", func->argc, dp->cArgs);
1060         return E_INVALIDARG;
1061     }
1062
1063     hres = IUnknown_QueryInterface(This->outer, tid_ids[func->tid], (void**)&iface);
1064     if(FAILED(hres))
1065         return hres;
1066
1067     for(i=0; i < func->argc; i++) {
1068         arg = dp->rgvarg+dp->cArgs-i-1;
1069         if(func->arg_types[i] == V_VT(arg)) {
1070             arg_ptrs[i] = arg;
1071         }else {
1072             hres = change_type(arg_buf+nconv, arg, func->arg_types[i], caller);
1073             if(FAILED(hres))
1074                 break;
1075             arg_ptrs[i] = arg_buf + nconv++;
1076         }
1077     }
1078
1079     if(SUCCEEDED(hres)) {
1080         if(func->prop_vt == VT_VOID) {
1081             V_VT(&retv) = VT_EMPTY;
1082         }else {
1083             V_VT(&retv) = func->prop_vt;
1084             arg_ptrs[func->argc] = &ret_ref;
1085             V_VT(&ret_ref) = VT_BYREF|func->prop_vt;
1086
1087             switch(func->prop_vt) {
1088 #define CASE_VT(vt,type,access)                         \
1089             case vt:                                    \
1090                 V_BYREF(&ret_ref) = &access(&retv);     \
1091                 break
1092             BUILTIN_TYPES_SWITCH;
1093 #undef CASE_VT
1094             default:
1095                 assert(0);
1096             }
1097         }
1098
1099         V_VT(&vhres) = VT_ERROR;
1100         hres = DispCallFunc(iface, func->call_vtbl_off*sizeof(void*), CC_STDCALL, VT_ERROR,
1101                     func->argc + (func->prop_vt == VT_VOID ? 0 : 1), func->arg_types, arg_ptrs, &vhres);
1102     }
1103
1104     while(nconv--)
1105         VariantClear(arg_buf+nconv);
1106     IUnknown_Release(iface);
1107     if(FAILED(hres))
1108         return hres;
1109     if(FAILED(V_ERROR(&vhres)))
1110         return V_ERROR(&vhres);
1111
1112     if(res)
1113         *res = retv;
1114     else
1115         VariantClear(&retv);
1116     return V_ERROR(&vhres);
1117 }
1118
1119 static HRESULT function_invoke(DispatchEx *This, func_info_t *func, WORD flags, DISPPARAMS *dp, VARIANT *res,
1120         EXCEPINFO *ei, IServiceProvider *caller)
1121 {
1122     HRESULT hres;
1123
1124     switch(flags) {
1125     case DISPATCH_METHOD|DISPATCH_PROPERTYGET:
1126         if(!res)
1127             return E_INVALIDARG;
1128         /* fall through */
1129     case DISPATCH_METHOD:
1130         if(This->dynamic_data && This->dynamic_data->func_disps
1131            && This->dynamic_data->func_disps[func->func_disp_idx].func_obj) {
1132             func_obj_entry_t *entry = This->dynamic_data->func_disps + func->func_disp_idx;
1133
1134             if(V_VT(&entry->val) != VT_DISPATCH) {
1135                 FIXME("calling %s not supported\n", debugstr_variant(&entry->val));
1136                 return E_NOTIMPL;
1137             }
1138
1139             if((IDispatch*)&entry->func_obj->dispex.IDispatchEx_iface != V_DISPATCH(&entry->val)) {
1140                 if(!V_DISPATCH(&entry->val)) {
1141                     FIXME("Calling null\n");
1142                     return E_FAIL;
1143                 }
1144
1145                 hres = invoke_disp_value(This, V_DISPATCH(&entry->val), 0, flags, dp, res, ei, NULL);
1146                 break;
1147             }
1148         }
1149
1150         if(func->call_vtbl_off)
1151             hres = invoke_builtin_function(This, func, dp, res, caller);
1152         else
1153             hres = typeinfo_invoke(This, func, flags, dp, res, ei);
1154         break;
1155     case DISPATCH_PROPERTYGET: {
1156         func_obj_entry_t *entry;
1157
1158         if(func->id == DISPID_VALUE) {
1159             BSTR ret;
1160
1161             ret = SysAllocString(objectW);
1162             if(!ret)
1163                 return E_OUTOFMEMORY;
1164
1165             V_VT(res) = VT_BSTR;
1166             V_BSTR(res) = ret;
1167             return S_OK;
1168         }
1169
1170         hres = get_func_obj_entry(This, func, &entry);
1171         if(FAILED(hres))
1172             return hres;
1173
1174         V_VT(res) = VT_EMPTY;
1175         return VariantCopy(res, &entry->val);
1176     }
1177     case DISPATCH_PROPERTYPUT: {
1178         func_obj_entry_t *entry;
1179
1180         if(dp->cArgs != 1 || (dp->cNamedArgs == 1 && *dp->rgdispidNamedArgs != DISPID_PROPERTYPUT)
1181            || dp->cNamedArgs > 1) {
1182             FIXME("invalid args\n");
1183             return E_INVALIDARG;
1184         }
1185
1186         /*
1187          * NOTE: Although we have IDispatchEx tests showing, that it's not allowed to set
1188          * function property using InvokeEx, it's possible to do that from jscript.
1189          * Native probably uses some undocumented interface in this case, but it should
1190          * be fine for us to allow IDispatchEx handle that.
1191          */
1192         hres = get_func_obj_entry(This, func, &entry);
1193         if(FAILED(hres))
1194             return hres;
1195
1196         return VariantCopy(&entry->val, dp->rgvarg);
1197     }
1198     default:
1199         FIXME("Unimplemented flags %x\n", flags);
1200         hres = E_NOTIMPL;
1201     }
1202
1203     return hres;
1204 }
1205
1206 static HRESULT invoke_builtin_prop(DispatchEx *This, DISPID id, LCID lcid, WORD flags, DISPPARAMS *dp,
1207         VARIANT *res, EXCEPINFO *ei, IServiceProvider *caller)
1208 {
1209     dispex_data_t *data;
1210     func_info_t *func;
1211     HRESULT hres;
1212
1213     data = get_dispex_data(This);
1214     if(!data)
1215         return E_FAIL;
1216
1217     hres = get_builtin_func(data, id, &func);
1218     if(id == DISPID_VALUE && hres == DISP_E_UNKNOWNNAME)
1219         return dispex_value(This, lcid, flags, dp, res, ei, caller);
1220     if(FAILED(hres))
1221         return hres;
1222
1223     if(func->func_disp_idx != -1)
1224         return function_invoke(This, func, flags, dp, res, ei, caller);
1225
1226     switch(flags) {
1227     case DISPATCH_PROPERTYPUT:
1228         if(res)
1229             V_VT(res) = VT_EMPTY;
1230         hres = builtin_propput(This, func, dp, caller);
1231         break;
1232     case DISPATCH_PROPERTYGET:
1233         hres = builtin_propget(This, func, dp, res);
1234         break;
1235     default:
1236         if(!func->get_vtbl_off) {
1237             hres = typeinfo_invoke(This, func, flags, dp, res, ei);
1238         }else {
1239             VARIANT v;
1240
1241             hres = builtin_propget(This, func, NULL, &v);
1242             if(FAILED(hres))
1243                 return hres;
1244
1245             if(flags != (DISPATCH_PROPERTYGET|DISPATCH_METHOD) || dp->cArgs) {
1246                 if(V_VT(&v) != VT_DISPATCH) {
1247                     FIXME("Not a function %s flags %08x\n", debugstr_variant(&v), flags);
1248                     VariantClear(&v);
1249                     return E_FAIL;
1250                 }
1251
1252                 hres = invoke_disp_value(This, V_DISPATCH(&v), lcid, flags, dp, res, ei, caller);
1253                 IDispatch_Release(V_DISPATCH(&v));
1254             }else if(res) {
1255                 *res = v;
1256             }else {
1257                 VariantClear(&v);
1258             }
1259         }
1260     }
1261
1262     return hres;
1263 }
1264
1265 HRESULT remove_attribute(DispatchEx *This, DISPID id, VARIANT_BOOL *success)
1266 {
1267     switch(get_dispid_type(id)) {
1268     case DISPEXPROP_CUSTOM:
1269         FIXME("DISPEXPROP_CUSTOM not supported\n");
1270         return E_NOTIMPL;
1271
1272     case DISPEXPROP_DYNAMIC: {
1273         DWORD idx = id - DISPID_DYNPROP_0;
1274         dynamic_prop_t *prop;
1275
1276         prop = This->dynamic_data->props+idx;
1277         VariantClear(&prop->var);
1278         prop->flags |= DYNPROP_DELETED;
1279         *success = VARIANT_TRUE;
1280         return S_OK;
1281     }
1282     case DISPEXPROP_BUILTIN: {
1283         VARIANT var;
1284         DISPPARAMS dp = {&var,NULL,1,0};
1285         dispex_data_t *data;
1286         func_info_t *func;
1287         HRESULT hres;
1288
1289         data = get_dispex_data(This);
1290         if(!data)
1291             return E_FAIL;
1292
1293         hres = get_builtin_func(data, id, &func);
1294         if(FAILED(hres))
1295             return hres;
1296
1297         /* For builtin functions, we set their value to the original function. */
1298         if(func->func_disp_idx != -1) {
1299             func_obj_entry_t *entry;
1300
1301             if(!This->dynamic_data || !This->dynamic_data->func_disps
1302                 || !This->dynamic_data->func_disps[func->func_disp_idx].func_obj) {
1303                 *success = VARIANT_FALSE;
1304                 return S_OK;
1305             }
1306
1307             entry = This->dynamic_data->func_disps + func->func_disp_idx;
1308             if(V_VT(&entry->val) == VT_DISPATCH
1309                     && V_DISPATCH(&entry->val) == (IDispatch*)&entry->func_obj->dispex.IDispatchEx_iface) {
1310                 *success = VARIANT_FALSE;
1311                 return S_OK;
1312             }
1313
1314             VariantClear(&entry->val);
1315             V_VT(&entry->val) = VT_DISPATCH;
1316             V_DISPATCH(&entry->val) = (IDispatch*)&entry->func_obj->dispex.IDispatchEx_iface;
1317             IDispatch_AddRef(V_DISPATCH(&entry->val));
1318             *success = VARIANT_TRUE;
1319             return S_OK;
1320         }
1321
1322         V_VT(&var) = VT_EMPTY;
1323         hres = builtin_propput(This, func, &dp, NULL);
1324         if(FAILED(hres))
1325             return hres;
1326
1327         *success = VARIANT_TRUE;
1328         return S_OK;
1329     }
1330     default:
1331         assert(0);
1332         return E_FAIL;
1333     }
1334 }
1335
1336 static inline DispatchEx *impl_from_IDispatchEx(IDispatchEx *iface)
1337 {
1338     return CONTAINING_RECORD(iface, DispatchEx, IDispatchEx_iface);
1339 }
1340
1341 static HRESULT WINAPI DispatchEx_QueryInterface(IDispatchEx *iface, REFIID riid, void **ppv)
1342 {
1343     DispatchEx *This = impl_from_IDispatchEx(iface);
1344
1345     return IUnknown_QueryInterface(This->outer, riid, ppv);
1346 }
1347
1348 static ULONG WINAPI DispatchEx_AddRef(IDispatchEx *iface)
1349 {
1350     DispatchEx *This = impl_from_IDispatchEx(iface);
1351
1352     return IUnknown_AddRef(This->outer);
1353 }
1354
1355 static ULONG WINAPI DispatchEx_Release(IDispatchEx *iface)
1356 {
1357     DispatchEx *This = impl_from_IDispatchEx(iface);
1358
1359     return IUnknown_Release(This->outer);
1360 }
1361
1362 static HRESULT WINAPI DispatchEx_GetTypeInfoCount(IDispatchEx *iface, UINT *pctinfo)
1363 {
1364     DispatchEx *This = impl_from_IDispatchEx(iface);
1365
1366     TRACE("(%p)->(%p)\n", This, pctinfo);
1367
1368     *pctinfo = 1;
1369     return S_OK;
1370 }
1371
1372 static HRESULT WINAPI DispatchEx_GetTypeInfo(IDispatchEx *iface, UINT iTInfo,
1373                                               LCID lcid, ITypeInfo **ppTInfo)
1374 {
1375     DispatchEx *This = impl_from_IDispatchEx(iface);
1376     HRESULT hres;
1377
1378     TRACE("(%p)->(%u %u %p)\n", This, iTInfo, lcid, ppTInfo);
1379
1380     hres = get_typeinfo(This->data->disp_tid, ppTInfo);
1381     if(FAILED(hres))
1382         return hres;
1383
1384     ITypeInfo_AddRef(*ppTInfo);
1385     return S_OK;
1386 }
1387
1388 static HRESULT WINAPI DispatchEx_GetIDsOfNames(IDispatchEx *iface, REFIID riid,
1389                                                 LPOLESTR *rgszNames, UINT cNames,
1390                                                 LCID lcid, DISPID *rgDispId)
1391 {
1392     DispatchEx *This = impl_from_IDispatchEx(iface);
1393     UINT i;
1394     HRESULT hres;
1395
1396     TRACE("(%p)->(%s %p %u %u %p)\n", This, debugstr_guid(riid), rgszNames, cNames,
1397           lcid, rgDispId);
1398
1399     for(i=0; i < cNames; i++) {
1400         hres = IDispatchEx_GetDispID(&This->IDispatchEx_iface, rgszNames[i], 0, rgDispId+i);
1401         if(FAILED(hres))
1402             return hres;
1403     }
1404
1405     return S_OK;
1406 }
1407
1408 static HRESULT WINAPI DispatchEx_Invoke(IDispatchEx *iface, DISPID dispIdMember,
1409                             REFIID riid, LCID lcid, WORD wFlags, DISPPARAMS *pDispParams,
1410                             VARIANT *pVarResult, EXCEPINFO *pExcepInfo, UINT *puArgErr)
1411 {
1412     DispatchEx *This = impl_from_IDispatchEx(iface);
1413
1414     TRACE("(%p)->(%d %s %d %d %p %p %p %p)\n", This, dispIdMember, debugstr_guid(riid),
1415           lcid, wFlags, pDispParams, pVarResult, pExcepInfo, puArgErr);
1416
1417     return IDispatchEx_InvokeEx(&This->IDispatchEx_iface, dispIdMember, lcid, wFlags, pDispParams,
1418             pVarResult, pExcepInfo, NULL);
1419 }
1420
1421 static HRESULT WINAPI DispatchEx_GetDispID(IDispatchEx *iface, BSTR bstrName, DWORD grfdex, DISPID *pid)
1422 {
1423     DispatchEx *This = impl_from_IDispatchEx(iface);
1424     dynamic_prop_t *dprop;
1425     HRESULT hres;
1426
1427     TRACE("(%p)->(%s %x %p)\n", This, debugstr_w(bstrName), grfdex, pid);
1428
1429     if(grfdex & ~(fdexNameCaseSensitive|fdexNameCaseInsensitive|fdexNameEnsure|fdexNameImplicit|FDEX_VERSION_MASK))
1430         FIXME("Unsupported grfdex %x\n", grfdex);
1431
1432     hres = get_builtin_id(This, bstrName, grfdex, pid);
1433     if(hres != DISP_E_UNKNOWNNAME)
1434         return hres;
1435
1436     hres = get_dynamic_prop(This, bstrName, grfdex, &dprop);
1437     if(FAILED(hres))
1438         return hres;
1439
1440     *pid = DISPID_DYNPROP_0 + (dprop - This->dynamic_data->props);
1441     return S_OK;
1442 }
1443
1444 static HRESULT WINAPI DispatchEx_InvokeEx(IDispatchEx *iface, DISPID id, LCID lcid, WORD wFlags, DISPPARAMS *pdp,
1445         VARIANT *pvarRes, EXCEPINFO *pei, IServiceProvider *pspCaller)
1446 {
1447     DispatchEx *This = impl_from_IDispatchEx(iface);
1448     HRESULT hres;
1449
1450     TRACE("(%p)->(%x %x %x %p %p %p %p)\n", This, id, lcid, wFlags, pdp, pvarRes, pei, pspCaller);
1451
1452     if(wFlags == (DISPATCH_PROPERTYPUT|DISPATCH_PROPERTYPUTREF))
1453         wFlags = DISPATCH_PROPERTYPUT;
1454
1455     switch(get_dispid_type(id)) {
1456     case DISPEXPROP_CUSTOM:
1457         if(!This->data->vtbl || !This->data->vtbl->invoke)
1458             return DISP_E_UNKNOWNNAME;
1459         return This->data->vtbl->invoke(This, id, lcid, wFlags, pdp, pvarRes, pei, pspCaller);
1460
1461     case DISPEXPROP_DYNAMIC: {
1462         DWORD idx = id - DISPID_DYNPROP_0;
1463         dynamic_prop_t *prop;
1464
1465         if(!get_dynamic_data(This) || This->dynamic_data->prop_cnt <= idx)
1466             return DISP_E_UNKNOWNNAME;
1467
1468         prop = This->dynamic_data->props+idx;
1469
1470         switch(wFlags) {
1471         case DISPATCH_METHOD|DISPATCH_PROPERTYGET:
1472             if(!pvarRes)
1473                 return E_INVALIDARG;
1474             /* fall through */
1475         case DISPATCH_METHOD:
1476             if(V_VT(&prop->var) != VT_DISPATCH) {
1477                 FIXME("invoke %s\n", debugstr_variant(&prop->var));
1478                 return E_NOTIMPL;
1479             }
1480
1481             return invoke_disp_value(This, V_DISPATCH(&prop->var), lcid, wFlags, pdp, pvarRes, pei, pspCaller);
1482         case DISPATCH_PROPERTYGET:
1483             if(prop->flags & DYNPROP_DELETED)
1484                 return DISP_E_UNKNOWNNAME;
1485             V_VT(pvarRes) = VT_EMPTY;
1486             return variant_copy(pvarRes, &prop->var);
1487         case DISPATCH_PROPERTYPUT:
1488             if(pdp->cArgs != 1 || (pdp->cNamedArgs == 1 && *pdp->rgdispidNamedArgs != DISPID_PROPERTYPUT)
1489                || pdp->cNamedArgs > 1) {
1490                 FIXME("invalid args\n");
1491                 return E_INVALIDARG;
1492             }
1493
1494             TRACE("put %s\n", debugstr_variant(pdp->rgvarg));
1495             VariantClear(&prop->var);
1496             hres = variant_copy(&prop->var, pdp->rgvarg);
1497             if(FAILED(hres))
1498                 return hres;
1499
1500             prop->flags &= ~DYNPROP_DELETED;
1501             return S_OK;
1502         default:
1503             FIXME("unhandled wFlags %x\n", wFlags);
1504             return E_NOTIMPL;
1505         }
1506     }
1507     case DISPEXPROP_BUILTIN:
1508         if(wFlags == DISPATCH_CONSTRUCT) {
1509             if(id == DISPID_VALUE) {
1510                 if(This->data->vtbl && This->data->vtbl->value) {
1511                     return This->data->vtbl->value(This, lcid, wFlags, pdp, pvarRes, pei, pspCaller);
1512                 }
1513                 FIXME("DISPATCH_CONSTRUCT flag but missing value function\n");
1514                 return E_FAIL;
1515             }
1516             FIXME("DISPATCH_CONSTRUCT flag without DISPID_VALUE\n");
1517             return E_FAIL;
1518         }
1519
1520         return invoke_builtin_prop(This, id, lcid, wFlags, pdp, pvarRes, pei, pspCaller);
1521     default:
1522         assert(0);
1523         return E_FAIL;
1524     }
1525 }
1526
1527 static HRESULT WINAPI DispatchEx_DeleteMemberByName(IDispatchEx *iface, BSTR bstrName, DWORD grfdex)
1528 {
1529     DispatchEx *This = impl_from_IDispatchEx(iface);
1530
1531     TRACE("(%p)->(%s %x)\n", This, debugstr_w(bstrName), grfdex);
1532
1533     /* Not implemented by IE */
1534     return E_NOTIMPL;
1535 }
1536
1537 static HRESULT WINAPI DispatchEx_DeleteMemberByDispID(IDispatchEx *iface, DISPID id)
1538 {
1539     DispatchEx *This = impl_from_IDispatchEx(iface);
1540
1541     TRACE("(%p)->(%x)\n", This, id);
1542
1543     /* Not implemented by IE */
1544     return E_NOTIMPL;
1545 }
1546
1547 static HRESULT WINAPI DispatchEx_GetMemberProperties(IDispatchEx *iface, DISPID id, DWORD grfdexFetch, DWORD *pgrfdex)
1548 {
1549     DispatchEx *This = impl_from_IDispatchEx(iface);
1550     FIXME("(%p)->(%x %x %p)\n", This, id, grfdexFetch, pgrfdex);
1551     return E_NOTIMPL;
1552 }
1553
1554 static HRESULT WINAPI DispatchEx_GetMemberName(IDispatchEx *iface, DISPID id, BSTR *pbstrName)
1555 {
1556     DispatchEx *This = impl_from_IDispatchEx(iface);
1557     dispex_data_t *data;
1558     func_info_t *func;
1559     HRESULT hres;
1560
1561     TRACE("(%p)->(%x %p)\n", This, id, pbstrName);
1562
1563     if(is_dynamic_dispid(id)) {
1564         DWORD idx = id - DISPID_DYNPROP_0;
1565
1566         if(!get_dynamic_data(This) || This->dynamic_data->prop_cnt <= idx)
1567             return DISP_E_UNKNOWNNAME;
1568
1569         *pbstrName = SysAllocString(This->dynamic_data->props[idx].name);
1570         if(!*pbstrName)
1571             return E_OUTOFMEMORY;
1572
1573         return S_OK;
1574     }
1575
1576     data = get_dispex_data(This);
1577     if(!data)
1578         return E_FAIL;
1579
1580     hres = get_builtin_func(data, id, &func);
1581     if(FAILED(hres))
1582         return hres;
1583
1584     *pbstrName = SysAllocString(func->name);
1585     if(!*pbstrName)
1586         return E_OUTOFMEMORY;
1587     return S_OK;
1588 }
1589
1590 static HRESULT WINAPI DispatchEx_GetNextDispID(IDispatchEx *iface, DWORD grfdex, DISPID id, DISPID *pid)
1591 {
1592     DispatchEx *This = impl_from_IDispatchEx(iface);
1593     dispex_data_t *data;
1594     func_info_t *func;
1595     HRESULT hres;
1596
1597     TRACE("(%p)->(%x %x %p)\n", This, grfdex, id, pid);
1598
1599     if(is_dynamic_dispid(id)) {
1600         DWORD idx = id - DISPID_DYNPROP_0;
1601
1602         if(!get_dynamic_data(This) || This->dynamic_data->prop_cnt <= idx)
1603             return DISP_E_UNKNOWNNAME;
1604
1605         while(++idx < This->dynamic_data->prop_cnt && This->dynamic_data->props[idx].flags & DYNPROP_DELETED);
1606
1607         if(idx == This->dynamic_data->prop_cnt) {
1608             *pid = DISPID_STARTENUM;
1609             return S_FALSE;
1610         }
1611
1612         *pid = DISPID_DYNPROP_0+idx;
1613         return S_OK;
1614     }
1615
1616     data = get_dispex_data(This);
1617     if(!data)
1618         return E_FAIL;
1619
1620     if(id == DISPID_STARTENUM) {
1621         func = data->funcs;
1622     }else {
1623         hres = get_builtin_func(data, id, &func);
1624         if(FAILED(hres))
1625             return hres;
1626         func++;
1627     }
1628
1629     while(func < data->funcs+data->func_cnt) {
1630         /* FIXME: Skip hidden properties */
1631         if(func->func_disp_idx == -1) {
1632             *pid = func->id;
1633             return S_OK;
1634         }
1635         func++;
1636     }
1637
1638     if(get_dynamic_data(This) && This->dynamic_data->prop_cnt) {
1639         *pid = DISPID_DYNPROP_0;
1640         return S_OK;
1641     }
1642
1643     *pid = DISPID_STARTENUM;
1644     return S_FALSE;
1645 }
1646
1647 static HRESULT WINAPI DispatchEx_GetNameSpaceParent(IDispatchEx *iface, IUnknown **ppunk)
1648 {
1649     DispatchEx *This = impl_from_IDispatchEx(iface);
1650     FIXME("(%p)->(%p)\n", This, ppunk);
1651     return E_NOTIMPL;
1652 }
1653
1654 static IDispatchExVtbl DispatchExVtbl = {
1655     DispatchEx_QueryInterface,
1656     DispatchEx_AddRef,
1657     DispatchEx_Release,
1658     DispatchEx_GetTypeInfoCount,
1659     DispatchEx_GetTypeInfo,
1660     DispatchEx_GetIDsOfNames,
1661     DispatchEx_Invoke,
1662     DispatchEx_GetDispID,
1663     DispatchEx_InvokeEx,
1664     DispatchEx_DeleteMemberByName,
1665     DispatchEx_DeleteMemberByDispID,
1666     DispatchEx_GetMemberProperties,
1667     DispatchEx_GetMemberName,
1668     DispatchEx_GetNextDispID,
1669     DispatchEx_GetNameSpaceParent
1670 };
1671
1672 BOOL dispex_query_interface(DispatchEx *This, REFIID riid, void **ppv)
1673 {
1674     if(IsEqualGUID(&IID_IDispatch, riid))
1675         *ppv = &This->IDispatchEx_iface;
1676     else if(IsEqualGUID(&IID_IDispatchEx, riid))
1677         *ppv = &This->IDispatchEx_iface;
1678     else if(IsEqualGUID(&IID_IDispatchJS, riid))
1679         *ppv = NULL;
1680     else if(IsEqualGUID(&IID_UndocumentedScriptIface, riid))
1681         *ppv = NULL;
1682     else
1683         return FALSE;
1684
1685     if(*ppv)
1686         IUnknown_AddRef((IUnknown*)*ppv);
1687     return TRUE;
1688 }
1689
1690 void dispex_traverse(DispatchEx *This, nsCycleCollectionTraversalCallback *cb)
1691 {
1692     dynamic_prop_t *prop;
1693
1694     if(!This->dynamic_data)
1695         return;
1696
1697     for(prop = This->dynamic_data->props; prop < This->dynamic_data->props + This->dynamic_data->prop_cnt; prop++) {
1698         if(V_VT(&prop->var) == VT_DISPATCH)
1699             note_cc_edge((nsISupports*)V_DISPATCH(&prop->var), "dispex_data", cb);
1700     }
1701
1702     /* FIXME: Traverse func_disps */
1703 }
1704
1705 void dispex_unlink(DispatchEx *This)
1706 {
1707     dynamic_prop_t *prop;
1708
1709     if(!This->dynamic_data)
1710         return;
1711
1712     for(prop = This->dynamic_data->props; prop < This->dynamic_data->props + This->dynamic_data->prop_cnt; prop++) {
1713         if(V_VT(&prop->var) == VT_DISPATCH) {
1714             V_VT(&prop->var) = VT_EMPTY;
1715             IDispatch_Release(V_DISPATCH(&prop->var));
1716         }else {
1717             VariantClear(&prop->var);
1718         }
1719     }
1720 }
1721
1722 void release_dispex(DispatchEx *This)
1723 {
1724     dynamic_prop_t *prop;
1725
1726     if(!This->dynamic_data)
1727         return;
1728
1729     for(prop = This->dynamic_data->props; prop < This->dynamic_data->props + This->dynamic_data->prop_cnt; prop++) {
1730         VariantClear(&prop->var);
1731         heap_free(prop->name);
1732     }
1733
1734     heap_free(This->dynamic_data->props);
1735
1736     if(This->dynamic_data->func_disps) {
1737         func_obj_entry_t *iter;
1738
1739         for(iter = This->dynamic_data->func_disps; iter < This->dynamic_data->func_disps+This->data->data->func_disp_cnt; iter++) {
1740             if(iter->func_obj) {
1741                 iter->func_obj->obj = NULL;
1742                 IDispatchEx_Release(&iter->func_obj->dispex.IDispatchEx_iface);
1743             }
1744             VariantClear(&iter->val);
1745         }
1746
1747         heap_free(This->dynamic_data->func_disps);
1748     }
1749
1750     heap_free(This->dynamic_data);
1751 }
1752
1753 void init_dispex(DispatchEx *dispex, IUnknown *outer, dispex_static_data_t *data)
1754 {
1755     dispex->IDispatchEx_iface.lpVtbl = &DispatchExVtbl;
1756     dispex->outer = outer;
1757     dispex->data = data;
1758     dispex->dynamic_data = NULL;
1759 }