Type::removeAbstractTypeUser crash when freeing module from ExecutionEngine

hi list,
I've got a situation where I'm constantly adding and removing Modules
from an ExecutionEngine. When removing a module and the jitstate is
freed, clean up of the StructLayoutMap ends up trying to access a Type
instance was was already freed by the removal of another Module. In
trying to debug this, it basically comes down to a Type instance
serving as key in StructLayoutMap::LayoutInfo that shouldn't be there
(or the Type key shouldn't have been freed although its refcount is

I've been scouring the code to find the point where types are added to
StructLayoutMap::LayoutInfo but can't find it. Looking in
TargetData.cpp shows no code that actually adds entries to the map
AFAICT and since StructLayoutMap is declared in the .cpp I don't see
how it could be done anywhere else. anyone know which line of code
adds types/info pairs to StructLayoutMap::LayoutInfo?

thanks in advance,

ok, let me try again. When a type is added to
StructLayoutMap::LayoutInfo as a key, where is its refcount
incremented? There seems to be an edge case where the Type is left in
the LayoutInfo map, but is freed due to a 0 refcount. I have this
problem in both 2.8 and 2.9.