fix invalid free() problem (bug 6658)