jscript: Fix various memory and reference count leaks.

dlls/jscript/array.c

@@ -586,8 +586,10 @@ static HRESULT Array_slice(script_ctx_t *ctx, vdisp_t *vthis, WORD flags, DISPPA
         if(hres == DISP_E_UNKNOWNNAME)
             continue;
 
-        if(SUCCEEDED(hres))
+        if(SUCCEEDED(hres)) {
             hres = jsdisp_propput_idx(arr, idx-start, &v, ei, sp);
+            VariantClear(&v);
+        }
 
         if(FAILED(hres)) {
             jsdisp_release(arr);

dlls/jscript/dispex.c

@@ -473,6 +473,8 @@ static ULONG WINAPI DispatchEx_Release(IDispatchEx *iface)
         }
         heap_free(This->props);
         script_release(This->ctx);
+        if(This->prototype)
+            jsdisp_release(This->prototype);
 
         if(This->builtin_info->destructor)
             This->builtin_info->destructor(This);

dlls/jscript/engine.c

@@ -1412,11 +1412,15 @@ HRESULT array_expression_eval(exec_ctx_t *ctx, expression_t *_expr, DWORD flags,
         exprval_release(&exprval);
     }
 
-    if(SUCCEEDED(hres))
+    if(SUCCEEDED(hres)) {
         hres = to_object(ctx->parser->script, &member, &obj);
+        if(FAILED(hres))
+            VariantClear(&val);
+    }
     VariantClear(&member);
     if(SUCCEEDED(hres)) {
         hres = to_string(ctx->parser->script, &val, ei, &str);
+        VariantClear(&val);
         if(SUCCEEDED(hres)) {
             if(flags & EXPR_STRREF) {
                 ret->type = EXPRVAL_NAMEREF;
@@ -1426,6 +1430,7 @@ HRESULT array_expression_eval(exec_ctx_t *ctx, expression_t *_expr, DWORD flags,
             }
 
             hres = disp_get_id(ctx->parser->script, obj, str, flags & EXPR_NEWREF ? fdexNameEnsure : 0, &id);
+            SysFreeString(str);
         }
 
         if(SUCCEEDED(hres)) {
@@ -1569,6 +1574,7 @@ HRESULT new_expression_eval(exec_ctx_t *ctx, expression_t *_expr, DWORD flags, j
     hres = disp_call(ctx->parser->script, V_DISPATCH(&constr), DISPID_VALUE,
                      DISPATCH_CONSTRUCT, &dp, &var, ei, NULL/*FIXME*/);
     IDispatch_Release(V_DISPATCH(&constr));
+    free_dp(&dp);
     if(FAILED(hres))
         return hres;
 
@@ -2490,6 +2496,7 @@ HRESULT plus_expression_eval(exec_ctx_t *ctx, expression_t *_expr, DWORD flags,
         return hres;
 
     hres = to_number(ctx->parser->script, &val, ei, &num);
+    VariantClear(&val);
     if(FAILED(hres))
         return hres;
 
@@ -2749,6 +2756,8 @@ HRESULT equal_expression_eval(exec_ctx_t *ctx, expression_t *_expr, DWORD flags,
         return hres;
 
     hres = equal_values(ctx, &rval, &lval, ei, &b);
+    VariantClear(&lval);
+    VariantClear(&rval);
     if(FAILED(hres))
         return hres;
 
@@ -2770,6 +2779,8 @@ HRESULT equal2_expression_eval(exec_ctx_t *ctx, expression_t *_expr, DWORD flags
         return hres;
 
     hres = equal2_values(&rval, &lval, &b);
+    VariantClear(&lval);
+    VariantClear(&rval);
     if(FAILED(hres))
         return hres;
 
@@ -2791,6 +2802,8 @@ HRESULT not_equal_expression_eval(exec_ctx_t *ctx, expression_t *_expr, DWORD fl
         return hres;
 
     hres = equal_values(ctx, &lval, &rval, ei, &b);
+    VariantClear(&lval);
+    VariantClear(&rval);
     if(FAILED(hres))
         return hres;
 
@@ -2812,6 +2825,8 @@ HRESULT not_equal2_expression_eval(exec_ctx_t *ctx, expression_t *_expr, DWORD f
         return hres;
 
     hres = equal2_values(&lval, &rval, &b);
+    VariantClear(&lval);
+    VariantClear(&rval);
     if(FAILED(hres))
         return hres;
 
@@ -3114,8 +3129,11 @@ HRESULT assign_expression_eval(exec_ctx_t *ctx, expression_t *_expr, DWORD flags
         exprval_release(&exprvalr);
     }
 
-    if(SUCCEEDED(hres))
+    if(SUCCEEDED(hres)) {
         hres = put_value(ctx->parser->script, &exprval, &rval, ei);
+        if(FAILED(hres))
+            VariantClear(&rval);
+    }
 
     exprval_release(&exprval);
     if(FAILED(hres))

dlls/jscript/error.c

@@ -330,6 +330,7 @@ static HRESULT error_constr(script_ctx_t *ctx, WORD flags, DISPPARAMS *dp,
             hres = create_error(ctx, constr, NULL, msg, &err);
         else
             hres = create_error(ctx, constr, &num, msg, &err);
+        SysFreeString(msg);
 
         if(FAILED(hres))
             return hres;

dlls/jscript/function.c

@@ -213,6 +213,7 @@ static HRESULT invoke_source(script_ctx_t *ctx, FunctionInstance *function, IDis
         hres = create_exec_ctx(ctx, this_obj, var_disp, scope, &exec_ctx);
         scope_release(scope);
     }
+    jsdisp_release(var_disp);
     if(FAILED(hres))
         return hres;
 

dlls/jscript/parser.y

@@ -1583,6 +1583,7 @@ void parser_release(parser_ctx_t *ctx)
     if(--ctx->ref)
         return;
 
+    script_release(ctx->script);
     heap_free(ctx->begin);
     jsheap_free(&ctx->heap);
     heap_free(ctx);

dlls/jscript/regexp.c

@@ -3667,8 +3667,11 @@ static HRESULT run_exec(script_ctx_t *ctx, vdisp_t *jsthis, VARIANT *arg, jsexce
         *ret = VARIANT_FALSE;
     }
 
-    if(input)
+    if(input) {
         *input = string;
+    }else {
+        SysFreeString(string);
+    }
     return S_OK;
 }
 

dlls/jscript/string.c

@@ -703,6 +703,7 @@ static HRESULT String_match(script_ctx_t *ctx, vdisp_t *jsthis, WORD flags, DISP
             break;
     }
 
+    heap_free(match_result);
     SysFreeString(val_str);
 
     if(SUCCEEDED(hres) && retv) {
@@ -795,7 +796,7 @@ static HRESULT rep_call(script_ctx_t *ctx, DispatchEx *func, const WCHAR *str, m
     if(SUCCEEDED(hres))
         hres = jsdisp_call_value(func, DISPATCH_METHOD, &dp, &var, ei, caller);
 
-    for(i=0; i < parens_cnt+1; i++) {
+    for(i=0; i < parens_cnt+3; i++) {
         if(i != parens_cnt+1)
             SysFreeString(V_BSTR(get_arg(&dp,i)));
     }