class C {
  static const int number = 50;
  static int arr[number];
};

Here's how it worked:
-GetTypeForDeclarator was called from both Sema::ActOnCXXMemberDeclarator and Sema::ActOnDeclarator.
-VariableArrayTypes are not uniqued so two VariableArrayTypes were created with the same DeclRefExpr.
-On exit they both tried to destroy that one DeclRefExpr.

The fix is not to use GetTypeForDeclarator from the Sema::ActOnCXXMemberDeclarator.

llvm-svn: 57313