From 1f7fb03ee9f45217e6fea452c203ba625401d8ee Mon Sep 17 00:00:00 2001
From: Daniel Lehman <dlehman@esri.com>
Date: Wed, 12 Aug 2015 12:46:44 -0700
Subject: [PATCH] msxml3: Fix crash when merging Text nodes.

---
 dlls/msxml3/node.c         |  4 +--
 dlls/msxml3/tests/domdoc.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+), 2 deletions(-)

diff --git a/dlls/msxml3/node.c b/dlls/msxml3/node.c
index 90b5bde61d9..f8d77613dd8 100644
--- a/dlls/msxml3/node.c
+++ b/dlls/msxml3/node.c
@@ -496,7 +496,7 @@ HRESULT node_insert_before(xmlnode *This, IXMLDOMNode *new_child, const VARIANT
             refcount = xmlnode_get_inst_cnt(node_obj);
 
         if (refcount) xmldoc_add_refs(before_node_obj->node->doc, refcount);
-        xmlAddPrevSibling(before_node_obj->node, node_obj->node);
+        node_obj->node = xmlAddPrevSibling(before_node_obj->node, node_obj->node);
         if (refcount) xmldoc_release_refs(doc, refcount);
         node_obj->parent = This->parent;
     }
@@ -508,7 +508,7 @@ HRESULT node_insert_before(xmlnode *This, IXMLDOMNode *new_child, const VARIANT
         if (refcount) xmldoc_add_refs(This->node->doc, refcount);
         /* xmlAddChild doesn't unlink node from previous parent */
         xmlUnlinkNode(node_obj->node);
-        xmlAddChild(This->node, node_obj->node);
+        node_obj->node = xmlAddChild(This->node, node_obj->node);
         if (refcount) xmldoc_release_refs(doc, refcount);
         node_obj->parent = This->iface;
     }
diff --git a/dlls/msxml3/tests/domdoc.c b/dlls/msxml3/tests/domdoc.c
index df71b49355e..ff6783b3a57 100644
--- a/dlls/msxml3/tests/domdoc.c
+++ b/dlls/msxml3/tests/domdoc.c
@@ -11935,6 +11935,71 @@ static void test_url(void)
     IXMLDOMDocument_Release(doc);
 }
 
+static void test_merging_text(void)
+{
+    IXMLDOMText *nodetext;
+    IXMLDOMText *newtext;
+    IXMLDOMElement *root;
+    IXMLDOMDocument *doc;
+    IXMLDOMNode *first;
+    HRESULT hr;
+    VARIANT v;
+    BSTR str;
+    int i;
+
+    doc = create_document(&IID_IXMLDOMDocument);
+
+    hr = IXMLDOMDocument_createElement(doc, _bstr_("Testing"), &root);
+    EXPECT_HR(hr, S_OK);
+
+    hr = IXMLDOMDocument_appendChild(doc, (IXMLDOMNode*)root, NULL);
+    EXPECT_HR(hr, S_OK);
+
+    /* test xmlAddChild */
+    for (i = 0; i < 10; i++)
+    {
+        str = SysAllocString(szstr1);
+        hr = IXMLDOMDocument_createTextNode(doc, str, &nodetext);
+        SysFreeString(str);
+        EXPECT_HR(hr, S_OK);
+
+        newtext = NULL;
+        hr = IXMLDOMElement_appendChild(root, (IXMLDOMNode*)nodetext, (IXMLDOMNode**)&newtext);
+        EXPECT_HR(hr, S_OK);
+        ok(nodetext == newtext, "expected %p, got %p\n", nodetext, newtext);
+
+        IXMLDOMText_Release(newtext);
+        IXMLDOMText_Release(nodetext);
+    }
+
+    /* test xmlAddPrevSibling */
+    hr = IXMLDOMElement_get_firstChild(root, &first);
+    EXPECT_HR(hr, S_OK);
+    V_VT(&v) = VT_UNKNOWN;
+    V_UNKNOWN(&v) = (IUnknown*)first;
+    for (i = 0; i < 10; i++)
+    {
+        str = SysAllocString(szstr2);
+        hr = IXMLDOMDocument_createTextNode(doc, str, &nodetext);
+        SysFreeString(str);
+        EXPECT_HR(hr, S_OK);
+
+        newtext = NULL;
+        hr = IXMLDOMElement_insertBefore(root, (IXMLDOMNode*)nodetext, v, (IXMLDOMNode**)&newtext);
+        EXPECT_HR(hr, S_OK);
+        ok(nodetext == newtext, "expected %p, got %p\n", nodetext, newtext);
+
+        IXMLDOMText_Release(newtext);
+        IXMLDOMText_Release(nodetext);
+    }
+
+    IXMLDOMNode_Release(first);
+    IXMLDOMElement_Release(root);
+    IXMLDOMDocument_Release(doc);
+
+    free_bstrs();
+}
+
 START_TEST(domdoc)
 {
     HRESULT hr;
@@ -12014,6 +12079,7 @@ START_TEST(domdoc)
     test_namedmap_newenum();
     test_xmlns_attribute();
     test_url();
+    test_merging_text();
 
     test_xsltemplate();
     test_xsltext();
-- 
2.11.4.GIT