Fix use-after-free in gfx::Image.

Fix use-after-free in gfx::Image.

ToImageSkia, ToUIImage and ToNSImage would insert an ImageRep into the
map, then return the pointer to the ImageRep. If the map already
contained a rep of that type, the new rep gets freed and the returned
pointer is dangling. Adds a CHECK for this case so it will now crash
cleanly.

This should not happen, but it is evidently possible. This could mean
that ToImageSkia is being called from two threads at the same time
(which is bad, because gfx::Image is not thread safe).

BUG=590882
Review URL: https://codereview.chromium.org/1773433002

Cr-Commit-Position: refs/heads/master@{#381141}
(cherry picked from commit 7e551c12da627989bf8f31afd7b671279113d92d)

Committed: https://chromium.googlesource.com/chromium/src/+/c275eea4617914c9c2479b2514e2d884643a55a2

[Matt Giuca, 2016-03-22 01:09:02]

Description was changed from

==========
Fix use-after-free in gfx::Image.

ToImageSkia, ToUIImage and ToNSImage would insert an ImageRep into the
map, then return the pointer to the ImageRep. If the map already
contained a rep of that type, the new rep gets freed and the returned
pointer is dangling. Adds a CHECK for this case so it will now crash
cleanly.

This should not happen, but it is evidently possible. This could mean
that ToImageSkia is being called from two threads at the same time
(which is bad, because gfx::Image is not thread safe).

BUG=590882

Review URL: https://codereview.chromium.org/1773433002

Cr-Commit-Position: refs/heads/master@{#381141}
(cherry picked from commit 7e551c12da627989bf8f31afd7b671279113d92d)
==========

to

==========
Fix use-after-free in gfx::Image.

ToImageSkia, ToUIImage and ToNSImage would insert an ImageRep into the
map, then return the pointer to the ImageRep. If the map already
contained a rep of that type, the new rep gets freed and the returned
pointer is dangling. Adds a CHECK for this case so it will now crash
cleanly.

This should not happen, but it is evidently possible. This could mean
that ToImageSkia is being called from two threads at the same time
(which is bad, because gfx::Image is not thread safe).

BUG=590882

Review URL: https://codereview.chromium.org/1773433002

Cr-Commit-Position: refs/heads/master@{#381141}
(cherry picked from commit 7e551c12da627989bf8f31afd7b671279113d92d)

Committed:
https://chromium.googlesource.com/chromium/src/+/c275eea4617914c9c2479b2514e2...
==========

[Matt Giuca, 2016-03-22 01:09:06]

Committed patchset #1 (id:1) manually as
c275eea4617914c9c2479b2514e2d884643a55a2.