This reverts commit cce809ac90. The code was actually correct: "expr" is never allocated when an error is returned. This means when the expression parser fails, deleting "expr" means deleting an uninitialized pointer.
cce809ac90