Bug 571208 - Fix crash in nestegg_free_packet. Only push non-NULL packets into packet queue. r=chris.double

content/media/webm/nsWebMReader.cpp

@@ -531,14 +531,13 @@ PRBool nsWebMReader::DecodeVideoFrame(PRBool &aKeyframeSkip,
         nestegg_free_packet(next_packet);
         return PR_FALSE;
       }
+      mVideoPackets.PushFront(next_packet);
     } else {
       r = nestegg_duration(mContext, &next_tstamp);
       if (r == -1) {
-        nestegg_free_packet(next_packet);
         return PR_FALSE;
       }
     }
-    mVideoPackets.PushFront(next_packet);
   }
 
   PRInt64 tstamp_ms = tstamp / NS_PER_MS;

content/media/webm/nsWebMReader.h

@@ -74,10 +74,12 @@ class PacketQueue : private nsDeque {
   }
   
   inline void Push(nestegg_packet* aItem) {
+    NS_ASSERTION(aItem, "NULL pushed to PacketQueue");
     nsDeque::Push(aItem);
   }
   
   inline void PushFront(nestegg_packet* aItem) {
+    NS_ASSERTION(aItem, "NULL pushed to PacketQueue");
     nsDeque::PushFront(aItem);
   }