fix a crash on invalid metadata, e.g.: call i32 @foo(), XXXX

We would return the error without inserting the new instruction
into the program, so it wouldn't get deallocated, and an abort
would trigger when the module was deleted. 

llvm-svn: 100602