Master

void CCScheduler::removeHashElement(_hashSelectorEntry *&pElement)
{
     cocos2d::CCObject *target = pElement->target;

    ccArrayFree(pElement->timers);
    HASH_DEL(m_pHashForTimers, pElement);
    CC_SAFE_FREE(pElement);

    // make sure the target is released after we have removed the hash element
    // otherwise we access invalid memory when the release call deletes the target
    // and the target calls removeAllSelectors() during its destructor
    target->release();
}

replace free with CC_SAFE_FREE, avoid wild pointer. when passing a pointer into a free- memory-function, we need to pass the reference of the pointer.