mshtml: Check if value is function only when it needs to be in invoke_builtin_prop.

dlls/mshtml/dispex.c

@@ -979,13 +979,13 @@ static HRESULT invoke_builtin_prop(DispatchEx *This, DISPID id, LCID lcid, WORD
             if(FAILED(hres))
                 return hres;
 
-            if(V_VT(&v) != VT_DISPATCH) {
-                FIXME("Not a function %s\n", debugstr_variant(&v));
-                VariantClear(&v);
-                return E_FAIL;
-            }
-
             if(flags != (DISPATCH_PROPERTYGET|DISPATCH_METHOD)) {
+                if(V_VT(&v) != VT_DISPATCH) {
+                    FIXME("Not a function %s\n", debugstr_variant(&v));
+                    VariantClear(&v);
+                    return E_FAIL;
+                }
+
                 hres = invoke_disp_value(This, V_DISPATCH(&v), lcid, flags, dp, res, ei, caller);
                 IDispatch_Release(V_DISPATCH(&v));
             }else if(res) {

dlls/mshtml/tests/vbtest.html

@@ -31,6 +31,7 @@ If true then counter = counter+1
 
 Sub runTest()
     Call ok(counter = 6, "counter = " & counter)
+    Call ok(isNull(document.onkeyup), "document.onkeyup is not null")
     Call external.reportSuccess()
 End Sub
 </script>