Do not access an invalidated reference in media::WebMListParser::OnListEnd().

media/formats/webm/webm_parser.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/formats/webm/webm_parser.h"
 
 // This file contains code to parse WebM file elements. It was created
 // from information in the Matroska spec.
 // http://www.matroska.org/technical/specs/index.html
 // This file contains code for encrypted WebM. Current WebM
@@ skipping 889 matching lines @@
   if (size == 0)
     return OnListEnd();
 
   return true;
 }
 
 bool WebMListParser::OnListEnd() {
   int lists_ended = 0;
   for (; !list_state_stack_.empty(); ++lists_ended) {
     const ListState& list_state = list_state_stack_.back();
+    int64 bytes_parsed = list_state.bytes_parsed_;
+    int id = list_state.id_;
 
-    if (list_state.bytes_parsed_ != list_state.size_)
+    if (bytes_parsed != list_state.size_)
       break;
 
     list_state_stack_.pop_back();
 
-    int64 bytes_parsed = list_state.bytes_parsed_;
     WebMParserClient* client = NULL;
     if (!list_state_stack_.empty()) {
       // Update the bytes_parsed_ for the parent element.
       list_state_stack_.back().bytes_parsed_ += bytes_parsed;
       client = list_state_stack_.back().client_;
     } else {
       client = root_client_;
     }
 
-    if (!client->OnListEnd(list_state.id_))
+    if (!client->OnListEnd(id))
       return false;
   }
 
   DCHECK_GE(lists_ended, 1);
 
   if (list_state_stack_.empty())
     ChangeState(DONE_PARSING_LIST);
 
   return true;
 }
 
 bool WebMListParser::IsSiblingOrAncestor(int id_a, int id_b) const {
   DCHECK((id_a == kWebMIdSegment) || (id_a == kWebMIdCluster));
 
   if (id_a == kWebMIdCluster) {
     // kWebMIdCluster siblings.
     for (size_t i = 0; i < arraysize(kSegmentIds); i++) {
       if (kSegmentIds[i].id_ == id_b)
         return true;
     }
   }
 
   // kWebMIdSegment siblings.
   return ((id_b == kWebMIdSegment) || (id_b == kWebMIdEBMLHeader));
 }
 
 }  // namespace media