4 files changed, 37 insertions, 22 deletions

diff --git a/lib/VMCore/IntrinsicInst.cpp b/lib/VMCore/IntrinsicInst.cpp
index d8f015a9e2c7..c37d5b03cdc8 100644
--- a/lib/VMCore/IntrinsicInst.cpp
+++ b/lib/VMCore/IntrinsicInst.cpp
@@ -24,8 +24,7 @@
 #include "llvm/IntrinsicInst.h"
 #include "llvm/Constants.h"
 #include "llvm/GlobalVariable.h"
-#include "llvm/Analysis/ValueTracking.h"
-#include "llvm/CodeGen/MachineModuleInfo.h"
+#include "llvm/Metadata.h"
 using namespace llvm;
 
 //===----------------------------------------------------------------------===//
diff --git a/lib/VMCore/LLVMContextImpl.h b/lib/VMCore/LLVMContextImpl.h
index 9887f28821ca..9978f40ed0da 100644
--- a/lib/VMCore/LLVMContextImpl.h
+++ b/lib/VMCore/LLVMContextImpl.h
@@ -105,6 +105,11 @@ public:
   StringMap<MDString*> MDStringCache;
   
   FoldingSet<MDNode> MDNodeSet;
+  // MDNodes may be uniqued or not uniqued.  When they're not uniqued, they
+  // aren't in the MDNodeSet, but they're still shared between objects, so no
+  // one object can destroy them.  This set allows us to at least destroy them
+  // on Context destruction.
+  SmallPtrSet<MDNode*, 1> NonUniquedMDNodes;
   
   ConstantUniqueMap<char, Type, ConstantAggregateZero> AggZeroConstants;
 
@@ -235,17 +240,21 @@ public:
       (*I)->AbstractTypeUsers.clear();
       delete *I;
     }
-    // Destroy MDNode operands first.
+    // Destroy MDNodes.  ~MDNode can move and remove nodes between the MDNodeSet
+    // and the NonUniquedMDNodes sets, so copy the values out first.
+    SmallVector<MDNode*, 8> MDNodes;
+    MDNodes.reserve(MDNodeSet.size() + NonUniquedMDNodes.size());
     for (FoldingSetIterator<MDNode> I = MDNodeSet.begin(), E = MDNodeSet.end();
-         I != E;) {
-      MDNode *N = &(*I);
-      ++I;
-      N->replaceAllOperandsWithNull();
+         I != E; ++I) {
+      MDNodes.push_back(&*I);
     }
-    while (!MDNodeSet.empty()) {
-      MDNode *N = &(*MDNodeSet.begin());
-      N->destroy();
+    MDNodes.append(NonUniquedMDNodes.begin(), NonUniquedMDNodes.end());
+    for (SmallVector<MDNode*, 8>::iterator I = MDNodes.begin(),
+           E = MDNodes.end(); I != E; ++I) {
+      (*I)->destroy();
     }
+    assert(MDNodeSet.empty() && NonUniquedMDNodes.empty() &&
+           "Destroying all MDNodes didn't empty the Context's sets.");
     // Destroy MDStrings.
     for (StringMap<MDString*>::iterator I = MDStringCache.begin(),
            E = MDStringCache.end(); I != E; ++I) {
diff --git a/lib/VMCore/Metadata.cpp b/lib/VMCore/Metadata.cpp
index 379aeb540a18..06d4fd4ae5c6 100644
--- a/lib/VMCore/Metadata.cpp
+++ b/lib/VMCore/Metadata.cpp
@@ -101,8 +101,10 @@ MDNode::MDNode(LLVMContext &C, Value *const *Vals, unsigned NumVals,
 MDNode::~MDNode() {
   assert((getSubclassDataFromValue() & DestroyFlag) != 0 &&
          "Not being destroyed through destroy()?");
-  if (!isNotUniqued()) {
-    LLVMContextImpl *pImpl = getType()->getContext().pImpl;
+  LLVMContextImpl *pImpl = getType()->getContext().pImpl;
+  if (isNotUniqued()) {
+    pImpl->NonUniquedMDNodes.erase(this);
+  } else {
     pImpl->MDNodeSet.RemoveNode(this);
   }
 
@@ -248,12 +250,10 @@ void MDNode::Profile(FoldingSetNodeID &ID) const {
     ID.AddPointer(getOperand(i));
 }
 
-// replaceAllOperandsWithNull - This is used while destroying llvm context to 
-// gracefully delete all nodes. This method replaces all operands with null.
-void MDNode::replaceAllOperandsWithNull() {
-  for (MDNodeOperand *Op = getOperandPtr(this, 0), *E = Op+NumOperands;
-       Op != E; ++Op)
-    replaceOperand(Op, 0);
+void MDNode::setIsNotUniqued() {
+  setValueSubclassData(getSubclassDataFromValue() | NotUniquedBit);
+  LLVMContextImpl *pImpl = getType()->getContext().pImpl;
+  pImpl->NonUniquedMDNodes.insert(this);
 }
 
 // Replace value from this node's operand list.
diff --git a/lib/VMCore/Type.cpp b/lib/VMCore/Type.cpp
index 9b2c2cab81fb..2a0cfa8470ea 100644
--- a/lib/VMCore/Type.cpp
+++ b/lib/VMCore/Type.cpp
@@ -87,6 +87,11 @@ void Type::destroy() const {
     pImpl->OpaqueTypes.erase(opaque_this);
   }
 
+  if (ForwardType && ForwardType->isAbstract()) {
+    ForwardType->dropRef();
+    ForwardType = NULL;
+  }
+
   // For all the other type subclasses, there is either no contained types or 
   // just one (all Sequentials). For Sequentials, the PATypeHandle is not
   // allocated past the type object, its included directly in the SequentialType
@@ -254,10 +259,12 @@ const Type *Type::getForwardedTypeInternal() const {
   // Yes, it is forwarded again.  First thing, add the reference to the new
   // forward type.
   if (RealForwardedType->isAbstract())
-    cast<DerivedType>(RealForwardedType)->addRef();
+    RealForwardedType->addRef();
 
   // Now drop the old reference.  This could cause ForwardType to get deleted.
-  cast<DerivedType>(ForwardType)->dropRef();
+  // ForwardType must be abstract because only abstract types can have their own
+  // ForwardTypes.
+  ForwardType->dropRef();
 
   // Return the updated type.
   ForwardType = RealForwardedType;
@@ -1142,8 +1149,8 @@ void DerivedType::unlockedRefineAbstractTypeTo(const Type *NewType) {
   // Any PATypeHolders referring to this type will now automatically forward to
   // the type we are resolved to.
   ForwardType = NewType;
-  if (NewType->isAbstract())
-    cast<DerivedType>(NewType)->addRef();
+  if (ForwardType->isAbstract())
+    ForwardType->addRef();
 
   // Add a self use of the current type so that we don't delete ourself until
   // after the function exits.