jscript: Fixed some leaks (coverity).

dlls/jscript/dispex.c

@@ -901,8 +901,10 @@ HRESULT create_dispex(script_ctx_t *ctx, const builtin_info_t *builtin_info, jsd
         return E_OUTOFMEMORY;
 
     hres = init_dispex(ret, ctx, builtin_info ? builtin_info : &dispex_info, prototype);
-    if(FAILED(hres))
+    if(FAILED(hres)) {
+        heap_free(ret);
         return hres;
+    }
 
     *dispex = ret;
     return S_OK;

dlls/jscript/function.c

@@ -578,8 +578,10 @@ static HRESULT create_function(script_ctx_t *ctx, const builtin_info_t *builtin_
         hres = init_dispex_from_constr(&function->dispex, ctx, builtin_info, ctx->function_constr);
     else
         hres = init_dispex_from_constr(&function->dispex, ctx, &FunctionInst_info, ctx->function_constr);
-    if(FAILED(hres))
+    if(FAILED(hres)) {
+        heap_free(function);
         return hres;
+    }
 
     function->flags = flags;
     function->length = flags & PROPF_ARGMASK;

dlls/jscript/number.c

@@ -609,8 +609,10 @@ static HRESULT alloc_number(script_ctx_t *ctx, jsdisp_t *object_prototype, Numbe
         hres = init_dispex(&number->dispex, ctx, &Number_info, object_prototype);
     else
         hres = init_dispex_from_constr(&number->dispex, ctx, &NumberInst_info, ctx->number_constr);
-    if(FAILED(hres))
+    if(FAILED(hres)) {
+        heap_free(number);
         return hres;
+    }
 
     *ret = number;
     return S_OK;

dlls/jscript/vbarray.c

@@ -184,6 +184,8 @@ static HRESULT VBArray_toArray(script_ctx_t *ctx, vdisp_t *vthis, WORD flags, un
 
     if(r)
         *r = jsval_obj(array);
+    else
+        jsdisp_release(array);
     return S_OK;
 }