From 8cb7dc2e40bc3aa2b2f8e73d3b298e7cc3f87228 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Gabriel=20Iv=C4=83ncescu?= <gabrielopcode@gmail.com>
Date: Wed, 30 Nov 2022 18:14:24 +0200
Subject: [PATCH] mshtml: Don't lock document mode when querying IEventTarget.
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>
---
 dlls/mshtml/oleobj.c    |  2 +-
 dlls/mshtml/tests/dom.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+), 1 deletion(-)

diff --git a/dlls/mshtml/oleobj.c b/dlls/mshtml/oleobj.c
index e6f5239538c..d1853435606 100644
--- a/dlls/mshtml/oleobj.c
+++ b/dlls/mshtml/oleobj.c
@@ -3380,7 +3380,7 @@ static HRESULT WINAPI HTMLDocumentObj_QueryInterface(IUnknown *iface, REFIID rii
     }else if(IsEqualGUID(&IID_IEventTarget, riid)) {
         /* IEventTarget is conditionally exposed. This breaks COM rules when
            it changes its compat mode, but it is how native works (see tests). */
-        if(!This->doc_node || dispex_compat_mode(&This->doc_node->node.event_target.dispex) < COMPAT_MODE_IE9) {
+        if(!This->doc_node || This->doc_node->document_mode < COMPAT_MODE_IE9) {
             *ppv = NULL;
             return E_NOINTERFACE;
         }
diff --git a/dlls/mshtml/tests/dom.c b/dlls/mshtml/tests/dom.c
index 4e6ad469b28..6a960bfa21f 100644
--- a/dlls/mshtml/tests/dom.c
+++ b/dlls/mshtml/tests/dom.c
@@ -11731,6 +11731,56 @@ static void test_quirks_mode(void)
                 "</html>", test_document_mode);
 }
 
+static void test_document_mode_lock(void)
+{
+    IEventTarget *event_target;
+    IPersistStreamInit *init;
+    IHTMLDocument2 *doc;
+    IStream *stream;
+    HRESULT hres;
+    HGLOBAL mem;
+    SIZE_T len;
+    MSG msg;
+
+    notif_doc = doc = create_document();
+    if(!doc)
+        return;
+    doc_complete = FALSE;
+
+    hres = IHTMLDocument2_QueryInterface(doc, &IID_IEventTarget, (void**)&event_target);
+    ok(hres == E_NOINTERFACE, "QueryInterface(IID_IEventTarget) returned %08lx.\n", hres);
+    ok(event_target == NULL, "event_target != NULL\n");
+
+    len = strlen(doc_blank_ie9);
+    mem = GlobalAlloc(0, len);
+    memcpy(mem, doc_blank_ie9, len);
+    hres = CreateStreamOnHGlobal(mem, TRUE, &stream);
+    ok(hres == S_OK, "Failed to create stream: %08lx.\n", hres);
+
+    hres = IHTMLDocument2_QueryInterface(doc, &IID_IPersistStreamInit, (void**)&init);
+    ok(hres == S_OK, "QueryInterface(IID_IPersistStreamInit) failed: %08lx.\n", hres);
+
+    IPersistStreamInit_Load(init, stream);
+    IPersistStreamInit_Release(init);
+    IStream_Release(stream);
+
+    set_client_site(doc, TRUE);
+    do_advise((IUnknown*)doc, &IID_IPropertyNotifySink, (IUnknown*)&PropertyNotifySink);
+
+    while(!doc_complete && GetMessageW(&msg, NULL, 0, 0)) {
+        TranslateMessage(&msg);
+        DispatchMessageW(&msg);
+    }
+
+    hres = IHTMLDocument2_QueryInterface(doc, &IID_IEventTarget, (void**)&event_target);
+    ok(hres == S_OK, "QueryInterface(IID_IEventTarget) returned %08lx.\n", hres);
+    ok(event_target != NULL, "event_target == NULL\n");
+    IEventTarget_Release(event_target);
+
+    set_client_site(doc, FALSE);
+    IHTMLDocument2_Release(doc);
+}
+
 static void test_custom_user_agent(IHTMLDocument2 *doc)
 {
     static const WCHAR ua[] = L"1234567890xxxABC";
@@ -11830,6 +11880,7 @@ START_TEST(dom)
     run_domtest(doctype_str, test_doctype);
 
     test_quirks_mode();
+    test_document_mode_lock();
 
     /* Run this last since it messes with the process-wide user agent */
     if (winetest_interactive || ! is_ie_hardened()) {
-- 
2.11.4.GIT