mono/mono — pull request #535 by madewokherd (2013-01-22 19:48:31+00:00)
Title: cominterop: Don't rely on an inner IUnknown to reference the outer objec...

Per COM aggregation rules (http://msdn.microsoft.com/en-us/library/windows/desktop/ms686558%28v=vs.85%29.aspx), the inner IUnknown interface is used by the outer object to control the lifetime of the inner object and access the interfaces it provides. Only the interfaces other than IUnknown maintain references to the outer object.

Since CoCreateFreeThreadedMarshaler only gives a reference to an IUnknown, the resulting object does not reference tunk. If tunk's reference count happens to be 0 when cominterop_ccw_getfreethreadedmarshaler begins, the release will actually free the FTMarshaler that was just created, causing a crash when we query for IMarshal. The solution is to query for IMarshal first, thus nailing down a reference to tunk.