http-push.c::remove_locks(): fix use after free