Hello.

I'm not sure but it seems to be a bug in the EndArray() function. After we got a replacement value from decoderEndArray() it has refcount=1. Then we assign the replacement value to a dictionary and the refcount becomes 2 but should be equal to 1 because no reference other than from the dictionary exists.