Fix IsolatedPrerender OnPrerenderDone crash

If a prerender finishes after a navigation, the page_ is no longer the
correct one. Adds an early return case from the previous DCHECKs.

Bug: 1116966
Change-Id: Iee1ca67d1a257a2390ff372dff94634db079197c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2359552
Auto-Submit: Robert Ogden <robertogden@chromium.org>
Commit-Queue: Ryan Sturm <ryansturm@chromium.org>
Reviewed-by: Ryan Sturm <ryansturm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#798720}

chrome/browser/prerender/isolated/isolated_prerender_tab_helper.cc

@@ -921,8 +921,14 @@ void IsolatedPrerenderTabHelper::DoNoStatePrefetch() {
 
 void IsolatedPrerenderTabHelper::OnPrerenderDone(const GURL& url) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  DCHECK(!page_->urls_to_no_state_prefetch_.empty());
-  DCHECK_EQ(url, page_->urls_to_no_state_prefetch_[0]);
+
+  // It is possible that this is run as a callback after a navigation has
+  // already happened and |page_| is now a different instance than when the
+  // prerender was started. In this case, just return.
+  if (page_->urls_to_no_state_prefetch_.empty() ||
+      url != page_->urls_to_no_state_prefetch_[0]) {
+    return;
+  }
 
   page_->no_state_prefetched_urls_.push_back(
       page_->urls_to_no_state_prefetch_[0]);