[Blob] Removed crash on race case blob messages

We have substantial crashes since adding bad_message errors for invalid
blob messages. It looks like there is a pre-existing condition where
blob references are race casing across processes.

While we investigate the issue, we want to remove this crash so it's not
making the situation worse (crashing instead of having a broken blob).

I'm keeping the uuid.empty() condition as a bad message, because that's
definitely an error that shouldn't be happening.

BUG=606065

Review URL: https://codereview.chromium.org/1913343002

Cr-Commit-Position: refs/heads/master@{#389868}

content/browser/blob_storage/blob_dispatcher_host.cc

@@ -219,26 +219,32 @@ void BlobDispatcherHost::OnCancelBuildingBlob(
 void BlobDispatcherHost::OnIncrementBlobRefCount(const std::string& uuid) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   BlobStorageContext* context = this->context();
-  if (uuid.empty() || !context->registry().HasEntry(uuid)) {
-    UMA_HISTOGRAM_ENUMERATION("Storage.Blob.InvalidReference", BDH_INCREMENT,
-                              BDH_TRACING_ENUM_LAST);
+  if (uuid.empty()) {
     bad_message::ReceivedBadMessage(
         this, bad_message::BDH_INVALID_REFCOUNT_OPERATION);
     return;
   }
+  if (!context->registry().HasEntry(uuid)) {
+    UMA_HISTOGRAM_ENUMERATION("Storage.Blob.InvalidReference", BDH_INCREMENT,
+                              BDH_TRACING_ENUM_LAST);
+    return;
+  }
   context->IncrementBlobRefCount(uuid);
   blobs_inuse_map_[uuid] += 1;
 }
 
 void BlobDispatcherHost::OnDecrementBlobRefCount(const std::string& uuid) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  if (uuid.empty() || !IsInUseInHost(uuid)) {
-    UMA_HISTOGRAM_ENUMERATION("Storage.Blob.InvalidReference", BDH_DECREMENT,
-                              BDH_TRACING_ENUM_LAST);
+  if (uuid.empty()) {
     bad_message::ReceivedBadMessage(
         this, bad_message::BDH_INVALID_REFCOUNT_OPERATION);
     return;
   }
+  if (!IsInUseInHost(uuid)) {
+    UMA_HISTOGRAM_ENUMERATION("Storage.Blob.InvalidReference", BDH_DECREMENT,
+                              BDH_TRACING_ENUM_LAST);
+    return;
+  }
   BlobStorageContext* context = this->context();
   context->DecrementBlobRefCount(uuid);
   blobs_inuse_map_[uuid] -= 1;
@@ -262,25 +268,30 @@ void BlobDispatcherHost::OnRegisterPublicBlobURL(const GURL& public_url,
                                                  const std::string& uuid) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   BlobStorageContext* context = this->context();
-  if (uuid.empty() || !IsInUseInHost(uuid) ||
-      context->registry().IsURLMapped(public_url)) {
-    UMA_HISTOGRAM_ENUMERATION("Storage.Blob.InvalidURLRegister", BDH_INCREMENT,
-                              BDH_TRACING_ENUM_LAST);
+  if (uuid.empty()) {
     bad_message::ReceivedBadMessage(this,
                                     bad_message::BDH_INVALID_URL_OPERATION);
     return;
   }
+  if (!IsInUseInHost(uuid) || context->registry().IsURLMapped(public_url)) {
+    UMA_HISTOGRAM_ENUMERATION("Storage.Blob.InvalidURLRegister", BDH_INCREMENT,
+                              BDH_TRACING_ENUM_LAST);
+    return;
+  }
   context->RegisterPublicBlobURL(public_url, uuid);
   public_blob_urls_.insert(public_url);
 }
 
 void BlobDispatcherHost::OnRevokePublicBlobURL(const GURL& public_url) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  if (!public_url.is_valid()) {
+    bad_message::ReceivedBadMessage(this,
+                                    bad_message::BDH_INVALID_URL_OPERATION);
+    return;
+  }
   if (!IsUrlRegisteredInHost(public_url)) {
     UMA_HISTOGRAM_ENUMERATION("Storage.Blob.InvalidURLRegister", BDH_DECREMENT,
                               BDH_TRACING_ENUM_LAST);
-    bad_message::ReceivedBadMessage(this,
-                                    bad_message::BDH_INVALID_URL_OPERATION);
     return;
   }
   context()->RevokePublicBlobURL(public_url);