Fix possible map::end() dereference in AppCacheUpdateJob triggered by a compromised renderer.

content/browser/appcache/appcache_update_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/appcache/appcache_update_job.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/compiler_specific.h"
 #include "base/strings/string_util.h"
@@ skipping 1087 matching lines @@
 
   AppCache* newest_cache = group_->newest_complete_cache();
   if (newest_cache)
     host_notifier->AddHosts(newest_cache->associated_hosts());
 }
 
 void AppCacheUpdateJob::OnDestructionImminent(AppCacheHost* host) {
   // The host is about to be deleted; remove from our collection.
   PendingMasters::iterator found =
       pending_master_entries_.find(host->pending_master_entry_url());
-  DCHECK(found != pending_master_entries_.end());
+  CHECK(found != pending_master_entries_.end());
   PendingHosts& hosts = found->second;
   PendingHosts::iterator it = std::find(hosts.begin(), hosts.end(), host);
-  DCHECK(it != hosts.end());
+  CHECK(it != hosts.end());
   hosts.erase(it);
 }
 
 void AppCacheUpdateJob::OnServiceReinitialized(
     AppCacheStorageReference* old_storage_ref) {
   // We continue to use the disabled instance, but arrange for its
   // deletion when its no longer needed.
   if (old_storage_ref->storage() == storage_)
     disabled_storage_reference_ = old_storage_ref;
 }
@@ skipping 576 matching lines @@
   // on this object after we've posted a task to delete ourselves.
   if (group_) {
     group_->SetUpdateAppCacheStatus(AppCacheGroup::IDLE);
     group_ = NULL;
   }
 
   base::MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
 }  // namespace content