Fix NULL pointer dereference in FinishedAsyncCopyRequest()

ui/snapshot/snapshot_aura.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/snapshot/snapshot.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ skipping 35 matching lines @@
 static void FinishedAsyncCopyRequest(
     std::unique_ptr<aura::WindowTracker> tracker,
     const gfx::Rect& source_rect,
     const cc::CopyOutputRequest::CopyOutputRequestCallback& callback,
     int retry_count,
     std::unique_ptr<cc::CopyOutputResult> result) {
   static const int kMaxRetries = 5;
   // Retry the copy request if the previous one failed for some reason.
   if (!tracker->windows().empty() && (retry_count < kMaxRetries) &&
       result->IsEmpty()) {
+    // Look up window before calling MakeAsyncRequest. Otherwise, due
+    // to undefined (favorably right to left) argument evaluation
+    // order, the tracker might have been passed and set to NULL
+    // before the window is looked up which results in a NULL pointer
+    // dereference.
+    gfx::NativeWindow window = tracker->windows()[0];
     MakeAsyncCopyRequest(
-        tracker->windows()[0], source_rect,
+        window, source_rect,
         base::Bind(&FinishedAsyncCopyRequest, base::Passed(&tracker),
                    source_rect, callback, retry_count + 1));
     return;
   }
 
   callback.Run(std::move(result));
 }
 
 static void MakeInitialAsyncCopyRequest(
     gfx::NativeWindow window,
@@ skipping 32 matching lines @@
 void GrabViewSnapshotAsync(
     gfx::NativeView view,
     const gfx::Rect& source_rect,
     scoped_refptr<base::TaskRunner> background_task_runner,
     const GrabWindowSnapshotAsyncPNGCallback& callback) {
   GrabWindowSnapshotAsync(view, source_rect, background_task_runner, callback);
 }
 
 
 }  // namespace ui