Fix use-after-free deleting from linked list.

runtime/vm/debugger.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/debugger.h"
 
 #include "include/dart_api.h"
 
 #include "vm/code_generator.h"
 #include "vm/code_patcher.h"
@@ skipping 2791 matching lines @@
         }
         return;
       }
 
       prev_bpt = curr_bpt;
       curr_bpt = curr_bpt->next();
     }
 
     if (curr_loc->breakpoints() == NULL) {
       if (prev_loc == NULL) {
-        breakpoint_locations_ = breakpoint_locations_->next();
+        breakpoint_locations_ = curr_loc->next();
       } else {
         prev_loc->set_next(curr_loc->next());
       }
 
       // Remove references from code breakpoints to this source breakpoint,
       // and disable the code breakpoints.
       UnlinkCodeBreakpoints(curr_loc);
+      BreakpointLocation* next_loc = curr_loc->next();
       delete curr_loc;
+      curr_loc = next_loc;
+    } else {
+      prev_loc = curr_loc;
+      curr_loc = curr_loc->next();
     }
-
-    prev_loc = curr_loc;
-    curr_loc = curr_loc->next();
   }
   // bpt is not a registered breakpoint, nothing to do.
 }
 
 
 // Turn code breakpoints associated with the given source breakpoint into
 // internal breakpoints. They will later be deleted when control
 // returns from the user-defined breakpoint callback. Also, disable the
 // breakpoint so it no longer fires if it should be hit before it gets
 // deleted.
@@ skipping 89 matching lines @@
 }
 
 
 void Debugger::RegisterCodeBreakpoint(CodeBreakpoint* bpt) {
   ASSERT(bpt->next() == NULL);
   bpt->set_next(code_breakpoints_);
   code_breakpoints_ = bpt;
 }
 
 }  // namespace dart