AppCache: fix a browser crashing bug that can happen during updates.

content/browser/appcache/appcache_update_job.cc

Index: content/browser/appcache/appcache_update_job.cc
diff --git a/content/browser/appcache/appcache_update_job.cc b/content/browser/appcache/appcache_update_job.cc
index e0c237261388f379a8370688a0acb8849bf1eb63..4b0d922f5e6fbf7d0becbfdb5880b6232b576534 100644
--- a/content/browser/appcache/appcache_update_job.cc
+++ b/content/browser/appcache/appcache_update_job.cc
@@ -406,11 +406,13 @@ AppCacheUpdateJob::~AppCacheUpdateJob() {
   if (internal_state_ != COMPLETED)
     Cancel();
 
-  DCHECK(!manifest_fetcher_);
-  DCHECK(pending_url_fetches_.empty());
   DCHECK(!inprogress_cache_.get());
   DCHECK(pending_master_entries_.empty());
-  DCHECK(master_entry_fetches_.empty());
+
+  // The job must not outlive any of its fetchers.
+  CHECK(!manifest_fetcher_);
+  CHECK(pending_url_fetches_.empty());
+  CHECK(master_entry_fetches_.empty());
 
   if (group_)
     group_->SetUpdateAppCacheStatus(AppCacheGroup::IDLE);
@@ -427,6 +429,9 @@ void AppCacheUpdateJob::StartUpdate(AppCacheHost* host,
     DCHECK(!new_master_resource.has_ref());
     DCHECK(new_master_resource.GetOrigin() == manifest_url_.GetOrigin());
 
+    if (ContainsKey(failed_master_entries_, new_master_resource))
+      return;
+
     // Cannot add more to this update if already terminating.
     if (IsTerminating()) {
       group_->QueueUpdate(host, new_master_resource);
@@ -864,6 +869,8 @@ void AppCacheUpdateJob::HandleMasterEntryFetchCompleted(
     }
     hosts.clear();
 
+    failed_master_entries_.insert(url);
+
     const char* kFormatString = "Manifest fetch failed (%d) %s";
     std::string message = FormatUrlErrorMessage(
         kFormatString, request->url(), fetcher->result(), response_code);