What were you doing?
test chromium webview


What happened?
Webview i build by self often crash on TileManager::OnRasterTaskCompleted in image_controller_.UnrefImages


What did you expect instead?
I think this code has danger to crash:
auto images_it = scheduled_draw_images_.find(tile_id);
image_controller_.UnrefImages(images_it->second);

for tile task that do not associated image decode task,
images_it may be end of scheduled_draw_images_, when call images_it->second, there will be crash by nullptr.

Please confirm this.


crash back trace:
    #00 pc 0031645e cc::ImageController::UnrefImages(std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > const&) LINE: image_controller.cc:146
    #01 lr 003209ed std::__ndk1::__bucket_list_deallocator<std::__ndk1::allocator<std::__ndk1::__hash_node<std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, void*>*> >::size() const LINE: __hash_table:710
(inlined by) std::__ndk1::__hash_table<std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, std::__ndk1::__unordered_map_hasher<unsigned long long, std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, std::__ndk1::hash<unsigned long long>, true>, std::__ndk1::__unordered_map_equal<unsigned long long, std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, std::__ndk1::equal_to<unsigned long long>, true>, std::__ndk1::allocator<std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > > > >::bucket_count() const LINE: __hash_table:941
(inlined by) std::__ndk1::__hash_table<std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, std::__ndk1::__unordered_map_hasher<unsigned long long, std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, std::__ndk1::hash<unsigned long long>, true>, std::__ndk1::__unordered_map_equal<unsigned long long, std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, std::__ndk1::equal_to<unsigned long long>, true>, std::__ndk1::allocator<std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > > > >::remove(std::__ndk1::__hash_const_iterator<std::__ndk1::__hash_node<std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, void*>*>) LINE: __hash_table:2221
(inlined by) std::__ndk1::__hash_table<std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, std::__ndk1::__unordered_map_hasher<unsigned long long, std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, std::__ndk1::hash<unsigned long long>, true>, std::__ndk1::__unordered_map_equal<unsigned long long, std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, std::__ndk1::equal_to<unsigned long long>, true>, std::__ndk1::allocator<std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > > > >::erase(std::__ndk1::__hash_const_iterator<std::__ndk1::__hash_node<std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, void*>*>) LINE: __hash_table:2154
(inlined by) std::__ndk1::unordered_map<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> >, std::__ndk1::hash<unsigned long long>, std::__ndk1::equal_to<unsigned long long>, std::__ndk1::allocator<std::__ndk1::pair<unsigned long long const, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > > > >::erase(std::__ndk1::__hash_map_const_iterator<std::__ndk1::__hash_const_iterator<std::__ndk1::__hash_node<std::__ndk1::__hash_value_type<unsigned long long, std::__ndk1::vector<cc::DrawImage, std::__ndk1::allocator<cc::DrawImage> > >, void*>*> >) LINE: unordered_map:948
(inlined by) cc::TileManager::OnRasterTaskCompleted(std::__ndk1::unique_ptr<cc::RasterBuffer, std::__ndk1::default_delete<cc::RasterBuffer> >, unsigned long long, cc::Resource*, bool) LINE: tile_manager.cc:1076