Fix possible map::end() dereference in AppCacheUpdateJob triggered by a compromised renderer.

content/browser/appcache/appcache_host_unittest.cc

Index: content/browser/appcache/appcache_host_unittest.cc
diff --git a/content/browser/appcache/appcache_host_unittest.cc b/content/browser/appcache/appcache_host_unittest.cc
index 817e8c0c924a6f2053e04d7255eb784f01df1930..255bfa9ab5bbe7bfb969aa681d5d6cc4ec7e0785 100644
--- a/content/browser/appcache/appcache_host_unittest.cc
+++ b/content/browser/appcache/appcache_host_unittest.cc
@@ -530,4 +530,17 @@ TEST_F(AppCacheHostTest, SelectCacheBlocked) {
   service_.set_quota_manager_proxy(NULL);
 }
 
+TEST_F(AppCacheHostTest, SelectCacheTwice) {
+  AppCacheHost host(1, &mock_frontend_, &service_);
+  const GURL kDocAndOriginUrl(GURL("http://whatever/").GetOrigin());
+
+  EXPECT_TRUE(host.SelectCache(kDocAndOriginUrl, kAppCacheNoCacheId, GURL()));
+
+  // Select methods should bail if cache has already been selected.
+  EXPECT_FALSE(host.SelectCache(kDocAndOriginUrl, kAppCacheNoCacheId, GURL()));
+  EXPECT_FALSE(host.SelectCacheForWorker(0, 0));
+  EXPECT_FALSE(host.SelectCacheForSharedWorker(kAppCacheNoCacheId));
+  EXPECT_FALSE(host.MarkAsForeignEntry(kDocAndOriginUrl, kAppCacheNoCacheId));
+}
+
 }  // namespace content