fix use after free case in VideoCaptureImpl.

It's possible client returns buffer after cached_dibs_ are freed.
Also fix a copy&paste error.

BUG=133096
TEST=the pages in bug 133096 do not crash.
Review URL: https://chromiumcodereview.appspot.com/10748018

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@146044 0039d316-1c4b-4281-b951-d872f2087c98

content/renderer/media/video_capture_impl.cc

@@ -227,7 +227,7 @@ void VideoCaptureImpl::DoStopCapture(
   if (it != clients_pending_on_restart_.end()) {
     handler->OnStopped(this);
     handler->OnRemoved(this);
-    clients_pending_on_filter_.erase(it);
+    clients_pending_on_restart_.erase(it);
     return;
   }
 
@@ -253,11 +253,12 @@ void VideoCaptureImpl::DoFeedBuffer(scoped_refptr<VideoFrameBuffer> buffer) {
       break;
   }
 
-  DCHECK(it != cached_dibs_.end());
-  DCHECK_GT(it->second->references, 0);
-  it->second->references--;
-  if (it->second->references == 0) {
-    Send(new VideoCaptureHostMsg_BufferReady(device_id_, it->first));
+  if (it != cached_dibs_.end() && it->second) {
+    DCHECK_GT(it->second->references, 0);
+    it->second->references--;
+    if (it->second->references == 0) {
+      Send(new VideoCaptureHostMsg_BufferReady(device_id_, it->first));
+    }
   }
 }