Fix use-after-free in MessageHandler.

runtime/vm/message_handler.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/message_handler.h"
 
 #include "vm/dart.h"
 #include "vm/lockers.h"
 #include "vm/port.h"
 
@@ skipping 139 matching lines @@
       OS::Print("[<] Handling message:\n"
                 "\thandler:    %s\n"
                 "\tport:       %" Pd64 "\n",
                 name(), message->dest_port());
     }
 
     // Release the monitor_ temporarily while we handle the message.
     // The monitor was acquired in MessageHandler::TaskCallback().
     monitor_.Exit();
     Message::Priority saved_priority = message->priority();
+    Dart_Port saved_dest_port = message->dest_port();
     result = HandleMessage(message);
+    message = NULL;  // May be deleted by now.
     monitor_.Enter();
     if (FLAG_trace_isolates) {
       OS::Print("[.] Message handled:\n"
                 "\thandler:    %s\n"
                 "\tport:       %" Pd64 "\n",
-                name(), message->dest_port());
+                name(), saved_dest_port);
     }
     if (!result) {
       // If we hit an error, we're done processing messages.
       break;
     }
     // Some callers want to process only one normal message and then quit. At
     // the same time it is OK to process multiple OOB messages.
     if ((saved_priority == Message::kNormalPriority) &&
         !allow_multiple_normal_messages) {
       break;
@@ skipping 132 matching lines @@
 
 void MessageHandler::decrement_live_ports() {
   MonitorLocker ml(&monitor_);
 #if defined(DEBUG)
   CheckAccess();
 #endif
   live_ports_--;
 }
 
 }  // namespace dart