CFI: avoid a bad cast in InsertBeforeAndInvalidateAllPointers.

cc/base/list_container.h

Index: cc/base/list_container.h
diff --git a/cc/base/list_container.h b/cc/base/list_container.h
index ec9c62dce52a7838bace6307cc0cdb3757a1a0e3..d5907407c0adc38d9fcf8c29f41233322f8cddeb 100644
--- a/cc/base/list_container.h
+++ b/cc/base/list_container.h
@@ -124,7 +124,7 @@ class ListContainer {
   template <typename DerivedElementType>
   DerivedElementType* ReplaceExistingElement(Iterator at) {
     at->~BaseElementType();
-    return new (*at) DerivedElementType();
+    return new (at.item_iterator) DerivedElementType();
   }
 
   // Insert |count| new elements of |DerivedElementType| before |at|. This will
@@ -135,7 +135,7 @@ class ListContainer {
     helper_.InsertBeforeAndInvalidateAllPointers(&at, count);
     Iterator result = at;
     for (size_t i = 0; i < count; ++i) {
-      new (*at) DerivedElementType();
+      new (at.item_iterator) DerivedElementType();
       ++at;
     }
     return result;