mshtml: Check if value is function only when it needs to be in invoke_builtin_prop.

dlls/mshtml/dispex.c

@@ -979,13 +979,13 @@ static HRESULT invoke_builtin_prop(DispatchEx *This, DISPID id, LCID lcid, WORD
             if(FAILED(hres))
                 return hres;
 
+            if(flags != (DISPATCH_PROPERTYGET|DISPATCH_METHOD)) {
                 if(V_VT(&v) != VT_DISPATCH) {
                     FIXME("Not a function %s\n", debugstr_variant(&v));
                     VariantClear(&v);
                     return E_FAIL;
                 }
 
-            if(flags != (DISPATCH_PROPERTYGET|DISPATCH_METHOD)) {
                 hres = invoke_disp_value(This, V_DISPATCH(&v), lcid, flags, dp, res, ei, caller);
                 IDispatch_Release(V_DISPATCH(&v));
             }else if(res) {

dlls/mshtml/tests/vbtest.html

@@ -31,6 +31,7 @@ If true then counter = counter+1
 
 Sub runTest()
     Call ok(counter = 6, "counter = " & counter)
+    Call ok(isNull(document.onkeyup), "document.onkeyup is not null")
     Call external.reportSuccess()
 End Sub
 </script>