Merge pull request #12289 from lonitra/backport12281

[release/8.0] Ensure proper ref count of underlying ocx

Author: lonitra

src/System.Windows.Forms/src/System/Windows/Forms/AxHost.cs

@@ -2326,13 +2326,13 @@ private void SetOcState(int nv)
     private void CreateWithoutLicense(Guid clsid)
     {
         s_axHTraceSwitch.TraceVerbose($"Creating object without license: {clsid}");
-        IUnknown* unknown;
+        using ComScope<IUnknown> unknown = new(null);
         HRESULT hr = PInvoke.CoCreateInstance(
             &clsid,
             (IUnknown*)null,
             CLSCTX.CLSCTX_INPROC_SERVER,
             IID.Get<IUnknown>(),
-            (void**)&unknown);
+            unknown);
         hr.ThrowOnFailure();
 
         _instance = Marshal.GetObjectForIUnknown((nint)unknown);
@@ -2356,8 +2356,8 @@ private void CreateWithLicense(string? license, Guid clsid)
 
             if (hr.Succeeded)
             {
-                IUnknown* unknown;
-                hr = factory.Value->CreateInstanceLic(null, null, IID.Get<IUnknown>(), new BSTR(license), (void**)&unknown);
+                using ComScope<IUnknown> unknown = new(null);
+                hr = factory.Value->CreateInstanceLic(null, null, IID.Get<IUnknown>(), new BSTR(license), unknown);
                 hr.ThrowOnFailure();
 
                 _instance = Marshal.GetObjectForIUnknown((nint)unknown);
@@ -3176,14 +3176,14 @@ public unsafe void ShowPropertyPages(Control control)
             transaction = host?.CreateTransaction(SR.AXEditProperties);
 
             HWND handle = ContainingControl is null ? HWND.Null : ContainingControl.HWND;
-            IUnknown* unknown = ComHelpers.GetComPointer<IUnknown>(_instance);
+            using var unknown = ComHelpers.GetComScope<IUnknown>(_instance);
             hr = PInvoke.OleCreatePropertyFrame(
                 handle,
                 0,
                 0,
                 (PCWSTR)null,
                 1,
-                &unknown,
+                unknown,
                 uuids.cElems,
                 uuids.pElems,
                 PInvoke.GetThreadLocale(),

src/System.Windows.Forms/tests/UnitTests/System/Windows/Forms/AxHostTests.cs

@@ -3073,6 +3073,18 @@ public void AxHost_ICustomTypeDescriptorGetPropertyOwner_InvokeWithHandle_Return
         Assert.Equal(0, createdCallCount);
     }
 
+    [WinFormsFact]
+    public unsafe void AxHost_Ocx_Dispose_Success()
+    {
+        SubAxHost control = new(WebBrowserClsidString);
+        control.CreateControl();
+        using var ocx = ComHelpers.GetComScope<IUnknown>(control.GetOcx());
+
+        control.Dispose();
+        ocx.Value->AddRef();
+        Assert.Equal((uint)0, ocx.Value->Release() - 1);
+    }
+
     private class SubComponentEditor : ComponentEditor
     {
         public override bool EditComponent(ITypeDescriptorContext context, object component)