shdocvw: Properly handle IEDocHost refcount.

dlls/shdocvw/ie.c

@@ -81,8 +81,10 @@ static ULONG WINAPI InternetExplorer_Release(IWebBrowser2 *iface)
     if(!ref) {
         if(This->doc_host) {
             DocHost_Release(&This->doc_host->doc_host);
-            if(This->doc_host)
+            if(This->doc_host) {
                 This->doc_host->ie = NULL;
+                This->doc_host->doc_host.container_vtbl->release(&This->doc_host->doc_host);
+            }
         }
 
         if(This->frame_hwnd)

dlls/shdocvw/iexplore.c

@@ -718,7 +718,7 @@ static ULONG IEDocHost_release(DocHost *iface)
 
     if(!ref) {
         if(This->ie)
-            This->ie->doc_host = NULL;
+            ERR("This->ie is not NULL\n");
         heap_free(This);
     }
 
@@ -777,6 +777,7 @@ static HRESULT create_ie(InternetExplorer **ret_obj)
     }
 
     ret->ref = 1;
+    ret->doc_host->ref = 1;
     ret->doc_host->ie = ret;
 
     DocHost_Init(&ret->doc_host->doc_host, (IDispatch*)&ret->IWebBrowser2_iface, &DocHostContainerVtbl);