exo: Fix null dereference in Buffer::ProduceTextureMailbox.

components/exo/buffer.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/exo/buffer.h"
 
 #include <GLES2/gl2.h>
 #include <GLES2/gl2ext.h>
 #include <GLES2/gl2extchromium.h>
 #include <stdint.h>
@@ skipping 331 matching lines @@
     return cc::SingleReleaseCallback::Create(
         base::Bind(&Buffer::Texture::ReleaseTexImage, base::Unretained(texture),
                    base::Bind(&Buffer::ReleaseContentsTexture, AsWeakPtr(),
                               base::Passed(&contents_texture_))));
   }
 
   // Create a mailbox texture that we copy the buffer contents to.
   if (!texture_)
     texture_ = make_scoped_ptr(new Texture(context_provider.get()));
 
+  // Copy the contents of |contents_texture| to |texture| and produce a
+  // texture mailbox from the result in |texture|.
+  Texture* contents_texture = contents_texture_.get();
   Texture* texture = texture_.get();
 
   // The contents texture will be released when copy has completed.
-  gpu::SyncToken sync_token = contents_texture_->CopyTexImage(
+  gpu::SyncToken sync_token = contents_texture->CopyTexImage(
       texture, base::Bind(&Buffer::ReleaseContentsTexture, AsWeakPtr(),
                           base::Passed(&contents_texture_)));
   *texture_mailbox = cc::TextureMailbox(
       texture->mailbox(), sync_token, GL_TEXTURE_2D,
       gpu_memory_buffer_->GetSize(), false /* is_overlay_candidate*/);
   // The mailbox texture will be released when no longer used by the
   // compositor.
   return cc::SingleReleaseCallback::Create(
       base::Bind(&Buffer::Texture::Release, base::Unretained(texture),
                  base::Bind(&Buffer::ReleaseTexture, AsWeakPtr(),
@@ skipping 33 matching lines @@
 }
 
 void Buffer::ReleaseContentsTexture(scoped_ptr<Texture> texture) {
   TRACE_EVENT0("exo", "Buffer::ReleaseContentsTexture");
 
   contents_texture_ = std::move(texture);
   Release();
 }
 
 }  // namespace exo