[Android] Fix iteration in GinJavaBridgeDispatcherHost::RemoveHolderAndAdvanceLocked

content/browser/android/java/gin_java_bridge_dispatcher_host.cc

Index: content/browser/android/java/gin_java_bridge_dispatcher_host.cc
diff --git a/content/browser/android/java/gin_java_bridge_dispatcher_host.cc b/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
index 048fd5f21e4c663b2c0017b71fb7bf0c0660683f..748bd8b2da7b09b8a50fdca45ae9bbeb3224254c 100644
--- a/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
+++ b/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
@@ -191,13 +191,16 @@ GinJavaBridgeDispatcherHost::RemoveHolderAndAdvanceLocked(
   objects_lock_.AssertAcquired();
   JavaObjectWeakGlobalRef result;
   scoped_refptr<GinJavaBoundObject> object((*iter_ptr)->second);
+  bool object_erased = false;
   if (!object->IsNamed()) {
     object->RemoveHolder(holder);
     if (!object->HasHolders()) {
       result = object->GetWeakRef();
       objects_.erase((*iter_ptr)++);
+      object_erased = true;
     }
-  } else {
+  }
+  if (!object_erased) {
     ++(*iter_ptr);
   }
   return result;