[Android] Fix iteration in GinJavaBridgeDispatcherHost::RemoveHolderAndAdvanceLocked

content/browser/android/java/gin_java_bridge_dispatcher_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/android/java/gin_java_bridge_dispatcher_host.h"
 
 #include "base/android/java_handler_thread.h"
 #include "base/android/jni_android.h"
 #include "base/android/scoped_java_ref.h"
 #include "base/atomic_sequence_num.h"
@@ skipping 173 matching lines @@
     return JavaObjectWeakGlobalRef();
 }
 
 JavaObjectWeakGlobalRef
 GinJavaBridgeDispatcherHost::RemoveHolderAndAdvanceLocked(
     int32 holder,
     ObjectMap::iterator* iter_ptr) {
   objects_lock_.AssertAcquired();
   JavaObjectWeakGlobalRef result;
   scoped_refptr<GinJavaBoundObject> object((*iter_ptr)->second);
+  bool object_erased = false;
   if (!object->IsNamed()) {
     object->RemoveHolder(holder);
     if (!object->HasHolders()) {
       result = object->GetWeakRef();
       objects_.erase((*iter_ptr)++);
+      object_erased = true;
     }
-  } else {
+  }
+  if (!object_erased) {
     ++(*iter_ptr);
   }
   return result;
 }
 
 void GinJavaBridgeDispatcherHost::RemoveFromRetainedObjectSetLocked(
     const JavaObjectWeakGlobalRef& ref) {
   objects_lock_.AssertAcquired();
   JNIEnv* env = base::android::AttachCurrentThread();
   base::android::ScopedJavaLocalRef<jobject> retained_object_set =
@@ skipping 268 matching lines @@
   if (iter == objects_.end())
     return;
   JavaObjectWeakGlobalRef ref =
       RemoveHolderAndAdvanceLocked(GetCurrentRoutingID(), &iter);
   if (!ref.is_empty()) {
     RemoveFromRetainedObjectSetLocked(ref);
   }
 }
 
 }  // namespace content