Fix IsolatedPrerender crash

This crash is caused by the callback being run after the original SRP
has been navigated away from, causing the metrics collector to be null.

This CL adds a check to skip the callback if the url isn't in the set
of predicted urls, and also adds an additional guard to check that the
metrics collector is not null.

Bug: 1141319,1136174
Change-Id: Ia8a8542cf5c6833abdd1e88d5c2317966ebf4cb7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2490211
Auto-Submit: Robert Ogden <robertogden@chromium.org>
Commit-Queue: Ryan Sturm <ryansturm@chromium.org>
Reviewed-by: Ryan Sturm <ryansturm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#819865}

chrome/browser/prerender/isolated/isolated_prerender_tab_helper.cc

@@ -1217,13 +1217,23 @@ void IsolatedPrerenderTabHelper::OnGotEligibilityResult(
     base::Optional<IsolatedPrerenderPrefetchStatus> status) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
+  // It is possible that this callback is being run late. That is, after the
+  // user has navigated away from the origin SRP. To detect this, check if the
+  // url exists in the set of predicted urls. If it doesn't, do nothing.
+  if (page_->original_prediction_ordering_.find(url) ==
+      page_->original_prediction_ordering_.end()) {
+    return;
+  }
+
   if (!eligible) {
     if (status) {
       OnPrefetchStatusUpdate(url, status.value());
 
-      DCHECK(page_->prefetch_metrics_collector_);
-      page_->prefetch_metrics_collector_->OnMainframeResourceNotEligible(
-          url, page_->original_prediction_ordering_.find(url)->second, *status);
+      if (page_->prefetch_metrics_collector_) {
+        page_->prefetch_metrics_collector_->OnMainframeResourceNotEligible(
+            url, page_->original_prediction_ordering_.find(url)->second,
+            *status);
+      }
     }
     return;
   }