The issue is that ac->output_elements is populated from ac->che, which may be freed, leaving dangling pointers in this list. Should fix clusterfuzz.