Fix possible map::end() dereference in AppCacheUpdateJob triggered by a compromised renderer.

content/browser/appcache/appcache_backend_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/appcache/appcache_backend_impl.h"
 
 #include "base/stl_util.h"
 #include "content/browser/appcache/appcache.h"
 #include "content/browser/appcache/appcache_group.h"
 #include "content/browser/appcache/appcache_service_impl.h"
@@ skipping 50 matching lines @@
   host->SetSpawningHostId(process_id_, spawning_host_id);
   return true;
 }
 
 bool AppCacheBackendImpl::SelectCache(
     int host_id,
     const GURL& document_url,
     const int64 cache_document_was_loaded_from,
     const GURL& manifest_url) {
   AppCacheHost* host = GetHost(host_id);
-  if (!host || host->was_select_cache_called())
+  if (!host)
     return false;
 
-  host->SelectCache(document_url, cache_document_was_loaded_from,
+  return host->SelectCache(document_url, cache_document_was_loaded_from,
                     manifest_url);
-  return true;
 }
 
 bool AppCacheBackendImpl::SelectCacheForWorker(
     int host_id, int parent_process_id, int parent_host_id) {
   AppCacheHost* host = GetHost(host_id);
-  if (!host || host->was_select_cache_called())
+  if (!host)
     return false;
 
-  host->SelectCacheForWorker(parent_process_id, parent_host_id);
-  return true;
+  return host->SelectCacheForWorker(parent_process_id, parent_host_id);
 }
 
 bool AppCacheBackendImpl::SelectCacheForSharedWorker(
     int host_id, int64 appcache_id) {
   AppCacheHost* host = GetHost(host_id);
-  if (!host || host->was_select_cache_called())
+  if (!host)
     return false;
 
-  host->SelectCacheForSharedWorker(appcache_id);
-  return true;
+  return host->SelectCacheForSharedWorker(appcache_id);
 }
 
 bool AppCacheBackendImpl::MarkAsForeignEntry(
     int host_id,
     const GURL& document_url,
     int64 cache_document_was_loaded_from) {
   AppCacheHost* host = GetHost(host_id);
   if (!host)
     return false;
 
-  host->MarkAsForeignEntry(document_url, cache_document_was_loaded_from);
-  return true;
+  return host->MarkAsForeignEntry(document_url, cache_document_was_loaded_from);
 }
 
 bool AppCacheBackendImpl::GetStatusWithCallback(
     int host_id, const GetStatusCallback& callback, void* callback_param) {
   AppCacheHost* host = GetHost(host_id);
   if (!host)
     return false;
 
   host->GetStatusWithCallback(callback, callback_param);
   return true;
@@ skipping 54 matching lines @@
   }
 
   delete found->second;
 
   // We take onwership.
   host->CompleteTransfer(new_host_id, frontend_);
   found->second = host.release();
 }
 
 }  // namespace content