Fix ClusterFuzz NPD

playerIDs were getting added to dead players, then removed from the
player map - when it came time to delete players, the dead players
tried to be removed again. Looks like CF was running without DCHECK
enabled, so it never hit the check for iter != players_.end().

Bug: 1148757
Change-Id: I13486c59ec362b023ddbf93462d359bec7707512
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2537789Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Andrey Kosyakov <caseq@chromium.org>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#827464}

third_party/blink/renderer/core/inspector/inspector_media_context_impl.cc

@@ -88,11 +88,13 @@ WebString MediaInspectorContextImpl::CreatePlayer() {
 }
 
 void MediaInspectorContextImpl::RemovePlayer(WebString playerId) {
-  const auto& player = players_.find(playerId);
-  DCHECK(player != players_.end());
+  const auto& player_iter = players_.find(playerId);
+  DCHECK(player_iter != players_.end());
+  const Member<MediaPlayer>& player = player_iter->value;
+  DCHECK(player);
+
   total_event_count_ -=
-      (player->value->errors.size() + player->value->events.size() +
-       player->value->messages.size());
+      player->errors.size() + player->events.size() + player->messages.size();
   players_.erase(playerId);
 }
 
@@ -134,7 +136,6 @@ void MediaInspectorContextImpl::DestroyPlayer(const WebString& playerId) {
     // unsent players become dead when destroyed.
     unsent_players_.EraseAt(unsent_players_.Find(String(playerId)));
     dead_players_.push_back(playerId);
-    players_.erase(playerId);
   } else {
     expendable_players_.push_back(playerId);
   }