+ if (ref == 0) { + HeapFree(GetProcessHeap(), 0, This); + HeapFree(GetProcessHeap(), 0, This->data); + }
This is dereferencing a pointer after it's been freed.
The loop in GetFrame seems unnecessarily complicated. If the size of each item in the array is the same, we don't really need to calculate it for each one, do we?