From 537876b98e3cc290c43843f76979f4cee8d4a35b Mon Sep 17 00:00:00 2001
From: Eric Fiselier <eric@efcs.ca>
Date: Thu, 19 Mar 2015 03:20:02 +0000
Subject: [PATCH] Fix use after free and calls to operator comma in debug mode

git-svn-id: https://llvm.org/svn/llvm-project/libcxx/trunk@232703 91177308-0d34-0410-b5e6-96231b3b80d8
---
 include/list  | 2 +-
 src/debug.cpp | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/list b/include/list
index 13e1199df..c1a7a1821 100644
--- a/include/list
+++ b/include/list
@@ -1480,7 +1480,7 @@ list<_Tp, _Alloc>::insert(const_iterator __p, _InpIter __f, _InpIter __l,
         try
         {
 #endif  // _LIBCPP_NO_EXCEPTIONS
-            for (++__f; __f != __l; ++__f, ++__e, ++__ds)
+            for (++__f; __f != __l; ++__f, (void) ++__e, (void) ++__ds)
             {
                 __hold.reset(__node_alloc_traits::allocate(__na, 1));
                 __node_alloc_traits::construct(__na, _VSTD::addressof(__hold->__value_), *__f);
diff --git a/src/debug.cpp b/src/debug.cpp
index 60694a3bd..b1a16e6e7 100644
--- a/src/debug.cpp
+++ b/src/debug.cpp
@@ -214,10 +214,10 @@ __libcpp_db::__erase_i(void* __i)
             else
                 q->__next_ = p->__next_;
             __c_node* c = p->__c_;
-            free(p);
             --__isz_;
             if (c != nullptr)
                 c->__remove(p);
+            free(p);
         }
     }
 }