53 - filter/map/callfunc: result/scope freed during a callback gc("collect")
54 - json_from_object: cached read method dangles after obj.read reassignment
55 - zlib def_object/inf_object
56 - socket.poll: result array freed during a user fileno() callback
57 - uvcount=0 resources leaked when reached via a retain=true sweep

Signed-off-by: Matthew Cather <mattbob4@gmail.com>

uc_json_from_object cached the read method via ucv_property_get,
which returns a borrow. If the user's read callback reassigned
obj.read, the original closure's last owning reference vanished
when the call frame popped, leaving the cached pointer dangling
for the next iteration's ucv_get.

Signed-off-by: Matthew Cather <mattbob4@gmail.com>

uc_filter and uc_map hold their result array in a C local; uc_callfunc
holds the saved previous globals scope. A gc("collect") triggered from
inside the user callback freed those values and left the builtin to
dereference a dangling pointer once control returned.

Push each onto the VM stack with ucv_get so they're rooted via vm->stack
across the call.

Signed-off-by: Matthew Cather <mattbob4@gmail.com>

A gc("collect") from inside a polled handle's fileno() method freed
the C-local result array out from under uc_socket_poll. Push it onto
the VM stack so it stays rooted across the call.

uc_fn_arg(i) peeks from the top, so it now sees the anchor instead of
the args; switch the loop to direct stack-index access via argoff.

Signed-off-by: Matthew Cather <mattbob4@gmail.com>

uc_zlib_def_object and uc_zlib_inf_object cached the read method via
ucv_property_get, which returns a borrow. If the user's read callback
reassigned obj.read, the original closure's last owning reference
vanished when the callframe popped, leaving the cached pointer dangling
for the next iteration's ucv_get.

Take an owning reference and release it at every exit path.

Signed-off-by: Matthew Cather <mattbob4@gmail.com>

ucv_free's retain=true path defers free() and expects the GC's second
pass to mop up UC_NULL items from vm->values. But resources with
uvcount=0 aren't on that list — ucv_resource_new_ex skips them because
leaf resources can't form cycles. So a retain=true sweep cascading into
one set type=UC_NULL and walked away; the memory leaked forever.

Only defer when ref is actually linked into a list.

Signed-off-by: Matthew Cather <mattbob4@gmail.com>