C：在错误的时间释放malloc数组？

struct cell

struct cell {
    double x, y, h, g, rhs;
    struct key *keys;
};

void cellFree(struct cell *c)   {
    // Free the keys
    free(c->keys);

    // Free the cell itself.
    free(c);
}

void cellFreeSors(struct cell *cn)  {
    int i;
    for(i = 0; i < 5; i++)  {
        // Free keys
        free(cn[i].keys);
    }
    // Free array
    free(cn);
}

struct cell * cellGetSuccessors(struct cell *c, struct cell *sstart, struct cell *sgoal, double km) {
        int i;

        // CREATE 5 CELLS
        struct cell *cn = malloc(5 * sizeof (struct cell));
            if (cn == NULL) {
            printf(\"--> Unable to malloc *cn!\\n\");
            errno = ENOMEM;
            return NULL;
            }

        for(i = 0; i < 5; i++)  {
            cn[i].keys = malloc(sizeof(struct key));
                if (cn[i].keys == NULL) {
                printf(\"--> Unable to malloc *cn[%d].keys!\\n\", i);
                errno = ENOMEM;
                return NULL;
            }
            cellCopyValues(&cn[i], c);
        }

        // MAKE THEM NEIGHBORS
        // PROCESS

        return cn;
    }


    double cellRHS(struct cell *c, struct cell *sstart, struct cell *sgoal, double km, struct cell * prevCell)  {
        // GET NEIGHBORS of c
        struct cell *cn = cellGetSuccessors(c, sstart, sgoal, km);
        double minsum;

        // SOME PROCESS TO UPDATE minsum
        minsum = 5.232111; // SAY

        // Free memory
        cellFreeSors(cn);

        return minsum;
    }

cellRHS()

cellFreeSors()

struct cell *u = cellCreateNew();
u->rhs = cellRHS(u, sstart, sgoal, km, prevCell);
queueAdd(&U, u);

    QUEUE CONTENTS
    ==================================================================
    F -> 0x2354550
    L - >0x2354550
    (1) [0x2354550] X 50.000000, Y 45.000000    PREV: (nil) NEXT: 0x4014000000000000
Segmentation fault

cellRHS()

struct cell *u = cellCreateNew();
queueAdd(&U, u);

    QUEUE CONTENTS
    ==================================================================
    F -> 0x2354550
    L - >0x2354550
    (1) [0x2354550] X 50.000000, Y 45.000000    PREV: (nil) NEXT: (nil)

cellFreeSors()

/* QUEUE NODE
 * ----------------------------
 * Contains a struct cell c and
 * reference to next queue_node
 */
struct queue_node   {
    struct cell *c;
    struct queue_node *next;
    struct queue_node *prev;
};

/* PRIORITY QUEUE
 * ----------------------------
 * The queue itself, with first
 * and last pointers to queue_nodes
 */
struct priority_queue   {
    struct queue_node *first;
    struct queue_node *last;
};

queuePrint()

void queuePrint(struct priority_queue *q)
{
    printf(\"\\n\\n\\tQUEUE CONTENTS\\n\\t==================================================================\\n\");
    int i = 1;
    struct queue_node *temp = q->first;
    printf(\"\\tF -> %p\\n\\tL -> %p\\n\", q->first, q->last);
    while(temp != NULL) {
        printf(\"\\t(%d) [%p]\\tX %f, Y %f\\tPREV: %p\\tNEXT: %p\", i, temp, temp->c->x, temp->c->y, temp->prev, temp->next);
        printf(\"\\n\");
        temp = temp->next;
        i++;
    }
    printf(\"\\n\\n\");
}