The children get cleaned up in L 95 by calling internal_clean_children. There's never a structure in split which has these bad pointers. This function (L 164) is just dealing with what the one block claims is its children even if its claiming ones which it shouldn't.