Fixes to possible GetLastError bugs

sandbox/win/src/restricted_token.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/restricted_token.h"
 
 #include <vector>
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 122 matching lines @@
                                      sids_to_restrict_array,
                                      &new_token_handle);
   } else {
     // Duplicate the token even if it's not modified at this point
     // because any subsequent changes to this token would also affect the
     // current process.
     result = ::DuplicateTokenEx(effective_token_.Get(), TOKEN_ALL_ACCESS, NULL,
                                 SecurityIdentification, TokenPrimary,
                                 &new_token_handle);
   }
+  auto last_error = ::GetLastError();
 
   if (deny_only_array)
     delete[] deny_only_array;
 
   if (sids_to_restrict_array)
     delete[] sids_to_restrict_array;
 
   if (privileges_to_disable_array)
     delete[] privileges_to_disable_array;
 
   if (!result)
-    return ::GetLastError();
+    return last_error;
 
   base::win::ScopedHandle new_token(new_token_handle);
 
   // Modify the default dacl on the token to contain Restricted and the user.
   if (!AddSidToDefaultDacl(new_token.Get(), WinRestrictedCodeSid, GENERIC_ALL))
     return ::GetLastError();
 
   if (!AddUserSidToDefaultDacl(new_token.Get(), GENERIC_ALL))
     return ::GetLastError();
 
@@ skipping 248 matching lines @@
 
   return ERROR_SUCCESS;
 }
 
 DWORD RestrictedToken::SetIntegrityLevel(IntegrityLevel integrity_level) {
   integrity_level_ = integrity_level;
   return ERROR_SUCCESS;
 }
 
 }  // namespace sandbox