Fix allocation bugs in server shutdown.
diff --git a/src/core/ext/transport/chttp2/server/chttp2_server.c b/src/core/ext/transport/chttp2/server/chttp2_server.c
index 50cbafa..dc85d1c 100644
--- a/src/core/ext/transport/chttp2/server/chttp2_server.c
+++ b/src/core/ext/transport/chttp2/server/chttp2_server.c
@@ -338,11 +338,12 @@
   }
   if (tcp_server) {
     grpc_tcp_server_unref(exec_ctx, tcp_server);
+  } else {
+    grpc_channel_args_destroy(state->args);
+    grpc_chttp2_server_handshaker_factory_destroy(exec_ctx,
+                                                  state->handshaker_factory);
+    gpr_free(state);
   }
-  grpc_channel_args_destroy(state->args);
-  grpc_chttp2_server_handshaker_factory_destroy(exec_ctx,
-                                                state->handshaker_factory);
-  gpr_free(state);
   *port_num = 0;
 
 done:
diff --git a/src/core/ext/transport/chttp2/server/secure/server_secure_chttp2.c b/src/core/ext/transport/chttp2/server/secure/server_secure_chttp2.c
index b9a8338..5f41728 100644
--- a/src/core/ext/transport/chttp2/server/secure/server_secure_chttp2.c
+++ b/src/core/ext/transport/chttp2/server/secure/server_secure_chttp2.c
@@ -69,6 +69,7 @@
       (server_security_handshaker_factory *)hf;
   GRPC_SECURITY_CONNECTOR_UNREF(&handshaker_factory->security_connector->base,
                                 "server");
+  gpr_free(hf);
 }
 
 static const grpc_chttp2_server_handshaker_factory_vtable
@@ -124,9 +125,6 @@
     gpr_log(GPR_ERROR, "%s", msg);
     grpc_error_free_string(msg);
     GRPC_ERROR_UNREF(err);
-    if (sc != NULL) {
-      GRPC_SECURITY_CONNECTOR_UNREF(&sc->base, "server");
-    }
   }
   return port_num;
 }