From: Benjamin Kramer <benny.kra@googlemail.com>
Date: Sun, 14 Oct 2012 08:48:40 +0000 (+0000)
Subject: Fix use after free when deleting attributes in a chained folding set.
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=fd8d62c0b449b9070dc18355ac243c7fa78d40d6;p=oota-llvm.git

Fix use after free when deleting attributes in a chained folding set.

Can't follow the intrusive linked list when the element is gone.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@165898 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/VMCore/LLVMContextImpl.cpp b/lib/VMCore/LLVMContextImpl.cpp
index a86363b632a..74247bdde13 100644
--- a/lib/VMCore/LLVMContextImpl.cpp
+++ b/lib/VMCore/LLVMContextImpl.cpp
@@ -97,9 +97,11 @@ LLVMContextImpl::~LLVMContextImpl() {
 
   // Destroy attributes.
   for (FoldingSetIterator<AttributesImpl> I = AttrsSet.begin(),
-         E = AttrsSet.end(); I != E; ++I)
-    delete &*I;
-  
+         E = AttrsSet.end(); I != E;) {
+    FoldingSetIterator<AttributesImpl> Elem = I++;
+    delete &*Elem;
+  }
+
   // Destroy MDNodes.  ~MDNode can move and remove nodes between the MDNodeSet
   // and the NonUniquedMDNodes sets, so copy the values out first.
   SmallVector<MDNode*, 8> MDNodes;