Random aborts in CXTPTooltipContext

We are still facing random aborts in the tooltip context code because of the unsafe code in SAFE_DELETEWINDOW macro.

I have posted on this before. The issue is quite simple. When using an HTML tooltip you can see the CJ code pumps messages after calling the web browser control's Navigate function. If a message makes it to the tooltip context code and it detects the "owner" has changed, the CJ code invokes the macro and not only destroys the window, but calls delete on m_pTooltip. Hence you are deleting an object that is executing code on the call stack. As the call stack eventually unwinds ... kaboom or corruption of memory occurs.

Now I am trying to fix the CJ code by adding reference counting and letting the tooltip delete itself when the ref count goes to zero. That led me to what looks like another bug in the CJ html tooltip code. The code calls IOleObject::SetClientSite(GetInterface(&IID_IOleClientSite)). This results in the OLE object add-ref'ing the html tooltip. Nowhere do I find the call to SetClientSite(NULL) to cause the references the OLE object holds to be released. I suppose the code never needed to call with NULL since it just blindly calls delete on the tooltip object.

So far I have had to define a virtual "SafeDelete" method and call if from the SAFE_DELETEWINDOW macro. After calling it I null out the pointer (so m_pTooltip is NULL) and in my SafeDelete implementation I have to call InternalRelease and "delete this" if the ref count is zero.

Due to the OleClientSite references, If my ref count is not zero, I have to call SetClientSite(NULL) and then check my ref count after that and delete if it is zero.

It would be really nice of CodeJock programmers to address this issue. And I have an easy way to let you duplicate the problem. Simply go into the code that calls Navigate and add a static variable to control exiting the loop based on the ready state:

while (rs != READYSTATE_COMPLETE || 1 == s_Stay);

Then move over a control on the ribbon, navigate and enter the loop. The tip won't display of course but now you can set breakpoints to see exactly what is occurring when you do the next step - move the cursor over another window that tips, say a shortcut menu or click on the App button and move over the system menu that drops down. The "owner" will change and the unsafe SAFE_DELETEWINDOW macro will be called. Now go back to the look and set a breakpoint in the loop at the PumpMessage call. Note the "this" pointer indicates it has been deleted (debug - feefeefeefee). Now set the s_Stay value to zero so you exit the loop.

Part of my fix is to define an InternalRelease method too. I also have to call InternalAddRef in the OnTimer function and InternalRelease when before leaving OnTimer. This all keeps the CJ tip context code from actually deleting the HTML tooltip object when it is pumping messages waiting for the ready state to be signaled. I take care of deleting the object when my ref count goes to zero.