From: trevor_hansen <trevor_hansen@e59a4935-1847-0410-ae03-e826735625c1>
Date: Sat, 28 Aug 2010 12:57:55 +0000 (+0000)
Subject: Bugfix. Memory was sometimes read after it had been freed by the garbage collector
X-Git-Url: https://git.unchartedbackwaters.co.uk/w/?a=commitdiff_plain;h=c23fb91712f28b1f9f9f27dd01982921516caa31;p=francis%2Fstp.git

Bugfix. Memory was sometimes read after it had been freed by the garbage collector

git-svn-id: https://stp-fast-prover.svn.sourceforge.net/svnroot/stp-fast-prover/trunk/stp@1004 e59a4935-1847-0410-ae03-e826735625c1
---

diff --git a/src/AST/ArrayTransformer.cpp b/src/AST/ArrayTransformer.cpp
index 6b85311..f3b0dae 100644
--- a/src/AST/ArrayTransformer.cpp
+++ b/src/AST/ArrayTransformer.cpp
@@ -450,7 +450,11 @@ namespace BEEV
               || SBVREM == k 
               || SBVMOD == k)
             {
-              const ASTNode& bottom = result[1];
+
+              // I had this as a reference, but that was wrong. Because
+              // "result" gets over-written in the next block, result[1], may
+              // get a reference count of zero, so be garbage collected.
+              const ASTNode bottom = result[1];
 
               if (SBVDIV == result.GetKind() 
                   || SBVREM == result.GetKind()