问C:在错误的时间释放malloc的数组？

EN

struct cell {
    double x, y, h, g, rhs;
    struct key *keys;
};

void cellFree(struct cell *c)   {
    // Free the keys
    free(c->keys);

    // Free the cell itself.
    free(c);
}

void cellFreeSors(struct cell *cn)  {
    int i;
    for(i = 0; i < 5; i++)  {
        // Free keys
        free(cn[i].keys);
    }
    // Free array
    free(cn);
}

struct cell * cellGetSuccessors(struct cell *c, struct cell *sstart, struct cell *sgoal, double km) {
        int i;

        // CREATE 5 CELLS
        struct cell *cn = malloc(5 * sizeof (struct cell));
            if (cn == NULL) {
            printf("--> Unable to malloc *cn!\n");
            errno = ENOMEM;
            return NULL;
            }

        for(i = 0; i < 5; i++)  {
            cn[i].keys = malloc(sizeof(struct key));
                if (cn[i].keys == NULL) {
                printf("--> Unable to malloc *cn[%d].keys!\n", i);
                errno = ENOMEM;
                return NULL;
            }
            cellCopyValues(&cn[i], c);
        }

        // MAKE THEM NEIGHBORS
        // PROCESS

        return cn;
    }


    double cellRHS(struct cell *c, struct cell *sstart, struct cell *sgoal, double km, struct cell * prevCell)  {
        // GET NEIGHBORS of c
        struct cell *cn = cellGetSuccessors(c, sstart, sgoal, km);
        double minsum;

        // SOME PROCESS TO UPDATE minsum
        minsum = 5.232111; // SAY

        // Free memory
        cellFreeSors(cn);

        return minsum;
    }

struct cell *u = cellCreateNew();
u->rhs = cellRHS(u, sstart, sgoal, km, prevCell);
queueAdd(&U, u);

    QUEUE CONTENTS
    ==================================================================
    F -> 0x2354550
    L - >0x2354550
    (1) [0x2354550] X 50.000000, Y 45.000000    PREV: (nil) NEXT: 0x4014000000000000
Segmentation fault

struct cell *u = cellCreateNew();
queueAdd(&U, u);

    QUEUE CONTENTS
    ==================================================================
    F -> 0x2354550
    L - >0x2354550
    (1) [0x2354550] X 50.000000, Y 45.000000    PREV: (nil) NEXT: (nil)

/* QUEUE NODE
 * ----------------------------
 * Contains a struct cell c and
 * reference to next queue_node
 */
struct queue_node   {
    struct cell *c;
    struct queue_node *next;
    struct queue_node *prev;
};

/* PRIORITY QUEUE
 * ----------------------------
 * The queue itself, with first
 * and last pointers to queue_nodes
 */
struct priority_queue   {
    struct queue_node *first;
    struct queue_node *last;
};

void queuePrint(struct priority_queue *q)
{
    printf("\n\n\tQUEUE CONTENTS\n\t==================================================================\n");
    int i = 1;
    struct queue_node *temp = q->first;
    printf("\tF -> %p\n\tL -> %p\n", q->first, q->last);
    while(temp != NULL) {
        printf("\t(%d) [%p]\tX %f, Y %f\tPREV: %p\tNEXT: %p", i, temp, temp->c->x, temp->c->y, temp->prev, temp->next);
        printf("\n");
        temp = temp->next;
        i++;
    }
    printf("\n\n");
}