UAF causing intermittent crashes about boolector

[mpreiner]

@cdisselkoen here is some more information what the next pointer is actually for:

next points to the next node in the collision chain of the unique node hash table.
So let's say you create node A, and afterwards node B and they happen to have the same hash value, you would get a collision chain like ... -> A -> B -> ..., i.e., A->next = B and B->next = .... If node B gets released, it gets removed from the collision chain and the list is updated accordingly, i.e., A->next = B->next, so A->next should not point to an invalid node. This happens in function remove_from_nodes_unique_table_exp.

[mpreiner]

@cdisselkoen any news on this issue?

[cdisselkoen]

Sorry for going silent there. I worked around the issue by removing the offending boolector_release operations, and instead just relying on boolector_release_all when done with a Btor instance.