[OT-PW] Fix a crash in a layout test

Currently the layout test parse-input-arguments-018.https.html is
crashing with virtual/threaded which runs off-thread paint worklet.
The problem is that CSSPaintImageGeneratorImpl::HasDocumentDefinition
does not check whether the definition is valid or not.

In particular, PaintWorkletProxyClient::RegisterCSSPaintDefinition
can register two different CSSPaintDefinition which would throw an
exception. But the |document_definition_map_| will still have an entry
for this CSSPaintDefinition and the value of the entry is nullptr.
In this case, the CSSPaintImageGeneratorImpl::HasDocumentDefinition
should return false.

Bug: 957459
Change-Id: Ic192676e537ce6b09bf56f244db61dac68598bff
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1662592
Commit-Queue: Xida Chen <xidachen@chromium.org>
Reviewed-by: Yi Gu <yigu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#670217}

third_party/blink/renderer/modules/csspaint/css_paint_image_generator_impl.cc

@@ -59,7 +59,7 @@ scoped_refptr<Image> CSSPaintImageGeneratorImpl::Paint(
 }
 
 bool CSSPaintImageGeneratorImpl::HasDocumentDefinition() const {
-  return paint_worklet_->GetDocumentDefinitionMap().Contains(name_);
+  return paint_worklet_->GetDocumentDefinitionMap().at(name_);
 }
 
 bool CSSPaintImageGeneratorImpl::GetValidDocumentDefinition(
@@ -77,8 +77,8 @@ bool CSSPaintImageGeneratorImpl::GetValidDocumentDefinition(
     DCHECK(definition);
     return true;
   }
-  if (definition && definition->GetRegisteredDefinitionCount() !=
-                        PaintWorklet::kNumGlobalScopesPerThread) {
+  if (definition->GetRegisteredDefinitionCount() !=
+      PaintWorklet::kNumGlobalScopesPerThread) {
     definition = nullptr;
     return false;
   }
@@ -91,8 +91,6 @@ unsigned CSSPaintImageGeneratorImpl::GetRegisteredDefinitionCountForTesting()
     return 0;
   DocumentPaintDefinition* definition =
       paint_worklet_->GetDocumentDefinitionMap().at(name_);
-  if (!definition)
-    return 0;
   return definition->GetRegisteredDefinitionCount();
 }
 

third_party/blink/web_tests/TestExpectations

@@ -4481,7 +4481,6 @@ crbug.com/957457 virtual/threaded/external/wpt/css/css-paint-api/background-imag
 crbug.com/957457 virtual/threaded/external/wpt/css/css-paint-api/geometry-background-image-tiled-001.https.html [ Crash ]
 crbug.com/957457 virtual/threaded/external/wpt/css/css-paint-api/invalid-image-pending-script.https.html [ Crash ]
 crbug.com/957457 virtual/threaded/external/wpt/css/css-paint-api/paint2d-image.https.html [ Failure Timeout ]
-crbug.com/957459 virtual/threaded/external/wpt/css/css-paint-api/parse-input-arguments-018.https.html [ Crash Failure ]
 crbug.com/957459 virtual/threaded/external/wpt/css/css-paint-api/registered-property-interpolation-004.https.html [ Failure ]
 crbug.com/957459 virtual/threaded/external/wpt/css/css-paint-api/registered-property-interpolation-010.https.html [ Failure ]
 crbug.com/957459 virtual/threaded/external/wpt/css/css-paint-api/registered-property-stylemap.https.html [ Failure ]