mshtml: Free the task after the destructor.

dlls/mshtml/navigate.c

@@ -1415,7 +1415,6 @@ static void stop_request_task_destr(task_t *_task)
     stop_request_task_t *task = (stop_request_task_t*)_task;
 
     IBindStatusCallback_Release(&task->bsc->bsc.IBindStatusCallback_iface);
-    free(task);
 }
 
 static HRESULT async_stop_request(nsChannelBSC *This)
@@ -1950,7 +1949,6 @@ static void start_doc_binding_task_destr(task_t *_task)
     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
 
     IHTMLWindow2_Release(&task->pending_window->base.IHTMLWindow2_iface);
-    free(task);
 }
 
 HRESULT async_start_doc_binding(HTMLOuterWindow *window, HTMLInnerWindow *pending_window, DWORD flags)
@@ -2107,7 +2105,6 @@ static void navigate_javascript_task_destr(task_t *_task)
     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
 
     IUri_Release(task->uri);
-    free(task);
 }
 
 typedef struct {
@@ -2139,7 +2136,6 @@ static void navigate_task_destr(task_t *_task)
     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
     IMoniker_Release(task->mon);
     IUri_Release(task->uri);
-    free(task);
 }
 
 static HRESULT navigate_fragment(HTMLOuterWindow *window, IUri *uri)

dlls/mshtml/nsio.c

@@ -986,7 +986,6 @@ static void start_binding_task_destr(task_t *_task)
     start_binding_task_t *task = (start_binding_task_t*)_task;
 
     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
-    free(task);
 }
 
 static nsresult async_open(nsChannel *This, HTMLOuterWindow *window, BOOL is_doc_channel, UINT32 load_type,

dlls/mshtml/olecmd.c

@@ -446,7 +446,6 @@ static void refresh_destr(task_t *_task)
     refresh_task_t *task = (refresh_task_t*)_task;
 
     IHTMLWindow2_Release(&task->window->base.IHTMLWindow2_iface);
-    free(task);
 }
 
 HRESULT reload_page(HTMLOuterWindow *window)

dlls/mshtml/persist.c

@@ -240,6 +240,10 @@ static void set_progress_proc(task_t *_task)
     }
 }
 
+static void set_progress_destr(task_t *_task)
+{
+}
+
 static void set_downloading_proc(task_t *_task)
 {
     download_proc_task_t *task = (download_proc_task_t*)_task;
@@ -275,7 +279,6 @@ static void set_downloading_task_destr(task_t *_task)
     download_proc_task_t *task = (download_proc_task_t*)_task;
 
     CoTaskMemFree(task->url);
-    free(task);
 }
 
 void prepare_for_binding(HTMLDocumentObj *This, IMoniker *mon, DWORD flags)
@@ -406,7 +409,7 @@ HRESULT set_moniker(HTMLOuterWindow *window, IMoniker *mon, IUri *nav_uri, IBind
 
             task = malloc(sizeof(docobj_task_t));
             task->doc = doc_obj;
-            hres = push_task(&task->header, set_progress_proc, NULL, doc_obj->task_magic);
+            hres = push_task(&task->header, set_progress_proc, set_progress_destr, doc_obj->task_magic);
             if(FAILED(hres)) {
                 CoTaskMemFree(url);
                 return hres;

dlls/mshtml/task.c

@@ -46,27 +46,20 @@ typedef struct {
     struct list entry;
 } task_timer_t;
 
-static void default_task_destr(task_t *task)
-{
-    free(task);
-}
-
 HRESULT push_task(task_t *task, task_proc_t proc, task_proc_t destr, LONG magic)
 {
     thread_data_t *thread_data;
 
     thread_data = get_thread_data(TRUE);
     if(!thread_data) {
-        if(destr)
         destr(task);
-        else
         free(task);
         return E_OUTOFMEMORY;
     }
 
     task->target_magic = magic;
     task->proc = proc;
-    task->destr = destr ? destr : default_task_destr;
+    task->destr = destr;
 
     list_add_tail(&thread_data->task_list, &task->entry);
 
@@ -128,6 +121,7 @@ void remove_target_tasks(LONG target)
         if(task->target_magic == target) {
             list_remove(&task->entry);
             task->destr(task);
+            free(task);
         }
     }
 }
@@ -341,6 +335,7 @@ static LRESULT WINAPI hidden_proc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lPa
 
             task->proc(task);
             task->destr(task);
+            free(task);
         }
 
         return 0;