Bug 1509562 Part 2 - Avoid UAF when resetting middleman calls, r=lsmyth.

--HG--
extra : rebase_source : 9b293c766746741b5835b924b89f246ce557f4c4

toolkit/recordreplay/MiddlemanCall.cpp

@@ -224,16 +224,21 @@ ResetMiddlemanCalls()
 
       MiddlemanCallContext cx(call, &arguments, MiddlemanCallPhase::MiddlemanRelease);
       GetRedirection(call->mCallId).mMiddlemanCall(cx);
-
-      delete call;
     }
   }
 
+  // Delete the calls in a second pass. The MiddlemanRelease phase depends on
+  // previous middleman calls still existing.
+  for (MiddlemanCall* call : gMiddlemanCalls) {
+    delete call;
+  }
+
   gMiddlemanCalls.clear();
   for (auto buffer : gAllocatedBuffers) {
     free(buffer);
   }
   gAllocatedBuffers.clear();
+  gMiddlemanCallMap->clear();
 }
 
 ///////////////////////////////////////////////////////////////////////////////