Your error is using allocating the object with malloc. Since gc doesn't see your AA, the AA is freed and you get UAF.