Fix NULL pointer dereference in FinishedAsyncCopyRequest()

ui/snapshot/snapshot_aura.cc

Index: ui/snapshot/snapshot_aura.cc
diff --git a/ui/snapshot/snapshot_aura.cc b/ui/snapshot/snapshot_aura.cc
index a3e8166a51d01016f52115efb7b35cb4d3c8ebe7..0f39b1138d58fd3f69fbceb46bd5c298e2909960 100644
--- a/ui/snapshot/snapshot_aura.cc
+++ b/ui/snapshot/snapshot_aura.cc
@@ -53,8 +53,14 @@ static void FinishedAsyncCopyRequest(
   // Retry the copy request if the previous one failed for some reason.
   if (!tracker->windows().empty() && (retry_count < kMaxRetries) &&
       result->IsEmpty()) {
+    // Look up window before calling MakeAsyncRequest. Otherwise, due
+    // to undefined (favorably right to left) argument evaluation
+    // order, the tracker might have been passed and set to NULL
+    // before the window is looked up which results in a NULL pointer
+    // dereference.
+    gfx::NativeWindow window = tracker->windows()[0];
     MakeAsyncCopyRequest(
-        tracker->windows()[0], source_rect,
+        window, source_rect,
         base::Bind(&FinishedAsyncCopyRequest, base::Passed(&tracker),
                    source_rect, callback, retry_count + 1));
     return;