Fix bug in MemEntryImpl, which caused browser crash during clearing

net/disk_cache/mem_backend_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/disk_cache/mem_backend_impl.h"
 
 #include "base/logging.h"
 #include "base/sys_info.h"
 #include "net/base/net_errors.h"
 #include "net/disk_cache/cache_util.h"
@@ skipping 232 matching lines @@
   return true;
 }
 
 bool MemBackendImpl::DoomEntriesBetween(const Time initial_time,
                                         const Time end_time) {
   if (end_time.is_null())
     return DoomEntriesSince(initial_time);
 
   DCHECK(end_time >= initial_time);
 
-  MemEntryImpl* next = rankings_.GetNext(NULL);
+  MemEntryImpl* node = rankings_.GetNext(NULL);
+  // Last valid entry before |node|.
+  // Note, that entries after |node| may become invalid during |node| doom in
+  // case when they are child entries of it. It is guaranteed that
+  // parent node will go prior to it childs in ranking list (see
+  // InternalReadSparseData and InternalWriteSparseData).
+  MemEntryImpl* last_valid = NULL;
 
   // rankings_ is ordered by last used, this will descend through the cache
   // and start dooming items before the end_time, and will stop once it reaches
   // an item used before the initial time.
-  while (next) {
-    MemEntryImpl* node = next;
-    next = rankings_.GetNext(next);
-
+  while (node) {
     if (node->GetLastUsed() < initial_time)
       break;
 
     if (node->GetLastUsed() < end_time)
       node->Doom();
+    else
+      last_valid = node;
+    node = rankings_.GetNext(last_valid);
   }
 
   return true;
 }
 
 bool MemBackendImpl::DoomEntriesSince(const Time initial_time) {
   for (;;) {
     // Get the entry in the front.
     Entry* entry = rankings_.GetNext(NULL);
 
@@ skipping 45 matching lines @@
   if (current_size_ > max_size_)
     TrimCache(false);
 }
 
 void MemBackendImpl::SubstractStorageSize(int32 bytes) {
   current_size_ -= bytes;
   DCHECK_GE(current_size_, 0);
 }
 
 }  // namespace disk_cache