mshtml: Check if event_table entry is allocated before using it in remove_event_handler.

dlls/mshtml/htmlevent.c

@@ -1077,7 +1077,7 @@ static HRESULT ensure_nsevent_handler(HTMLDocumentNode *doc, event_target_t *eve
 
 static HRESULT remove_event_handler(event_target_t **event_target, eventid_t eid)
 {
-    if(*event_target && (*event_target)->event_table[eid]->handler_prop) {
+    if(*event_target && (*event_target)->event_table[eid] && (*event_target)->event_table[eid]->handler_prop) {
         IDispatch_Release((*event_target)->event_table[eid]->handler_prop);
         (*event_target)->event_table[eid]->handler_prop = NULL;
     }

dlls/mshtml/tests/events.c

@@ -1172,6 +1172,10 @@ static void test_onclick(IHTMLDocument2 *doc)
     hres = IHTMLElement_put_onclick(div, v);
     ok(hres == S_OK, "put_onclick failed: %08x\n", hres);
 
+    V_VT(&v) = VT_NULL;
+    hres = IHTMLElement_put_ondblclick(div, v);
+    ok(hres == S_OK, "put_ondblclick failed: %08x\n", hres);
+
     V_VT(&v) = VT_EMPTY;
     hres = IHTMLElement_get_onclick(div, &v);
     ok(hres == S_OK, "get_onclick failed: %08x\n", hres);