Hosted ActiveX controls don't get deleted if scriptable interface is used

What steps will reproduce the problem?
1. Load a page with an embedded a ActiveX control
2. Call a function on the control via JavaScript
3. Navigate away from the page

What is the expected output? What do you see instead?
NPP_Destroy is called and the CAxHost is deleted.  However, the underlying 
ActiveX control is not deleted.  (Set a breakpoint in the ActiveX control's 
destructor to confirm that it is never called)

What version of the product are you using? On what operating system?
Head revision (14e849830355) on Win7

Please provide any additional information below.

I've attached a patch to fix the problem.  In the scriptable interface the 
following code was used:

    IDispatchPtr disp = control.GetInterfacePtr();
    disp->AddRef();

IDispatchPtr is a smart pointer that does an AddRef in it's ctor
and a Release in its dtor.  Manually calling AddRef was unnecessary.
Doing so caused the reference count to be artifically high since there
was no corresponding Release.

Each time ResolveName or InvokeControl was called, the reference count would go 
up by 1.  This prevented the count from ever reaching 0 so the control was 
never deleted.

Original issue reported on code.google.com by mikeyk...@gmail.com on 21 Oct 2011 at 10:08

Attachments:

leak.txt

Sp00f / ff-activex-host

Hosted ActiveX controls don't get deleted if scriptable interface is used #17