components/metrics: Fix use-after-free in CallStackManager

components/metrics/leak_detector/call_stack_manager.cc

Index: components/metrics/leak_detector/call_stack_manager.cc
diff --git a/components/metrics/leak_detector/call_stack_manager.cc b/components/metrics/leak_detector/call_stack_manager.cc
index de9fcd825aca246b786c5ee7bef9902c1c9ef105..dfebd3c7251dc19da6271f570ee28cb963a0e271 100644
--- a/components/metrics/leak_detector/call_stack_manager.cc
+++ b/components/metrics/leak_detector/call_stack_manager.cc
@@ -16,7 +16,13 @@ namespace leak_detector {
 CallStackManager::CallStackManager() {}
 
 CallStackManager::~CallStackManager() {
-  for (CallStack* call_stack : call_stacks_) {
+  // Free all call stack objects and clear |call_stacks_|. Make sure to save the
+  // CallStack object pointer and remove it from the container before freeing
+  // the CallStack memory.
+  while (!call_stacks_.empty()) {
+    CallStack* call_stack = *call_stacks_.begin();
+    call_stacks_.erase(call_stacks_.begin());
+
     CustomAllocator::Free(call_stack->stack,
                           call_stack->depth * sizeof(*call_stack->stack));
     call_stack->stack = nullptr;
@@ -24,7 +30,6 @@ CallStackManager::~CallStackManager() {
 
     CustomAllocator::Free(call_stack, sizeof(CallStack));
   }
-  call_stacks_.clear();
 }
 
 const CallStack* CallStackManager::GetCallStack(size_t depth,