Looking at this, where is `self.data` set to null? I don't remember if destructors zero out the whole structure or just the drop flag, but it seems like without the drop flag this could be run twice and `self.data` is non-null both times?