When Ulpfec recovers a packet, set |returned| flag earlier.

webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 223 matching lines @@
     RTC_DCHECK(received_packets_.empty());
   }
   // Send any recovered media packets to VCM.
   for (const auto& recovered_packet : recovered_packets_) {
     if (recovered_packet->returned) {
       // Already sent to the VCM and the jitter buffer.
       continue;
     }
     ForwardErrorCorrection::Packet* packet = recovered_packet->pkt;
     ++packet_counter_.num_recovered_packets;
+    // Set this flag first; in case the recovered packet carries a RED
+    // header, OnRecoveredPacket will recurse back here.
+    recovered_packet->returned = true;
     crit_sect_.Leave();
     recovered_packet_callback_->OnRecoveredPacket(packet->data,
                                                   packet->length);
     crit_sect_.Enter();
-    recovered_packet->returned = true;
   }
   crit_sect_.Leave();
   return 0;
 }
 
 }  // namespace webrtc