Fix bug in MemEntryImpl, which caused browser crash during clearing

net/disk_cache/mem_backend_impl.cc

Index: net/disk_cache/mem_backend_impl.cc
===================================================================
--- net/disk_cache/mem_backend_impl.cc	(revision 194868)
+++ net/disk_cache/mem_backend_impl.cc	(working copy)
@@ -250,20 +250,26 @@
 
   DCHECK(end_time >= initial_time);
 
-  MemEntryImpl* next = rankings_.GetNext(NULL);
+  MemEntryImpl* node = rankings_.GetNext(NULL);
+  // Last valid entry before |node|.
+  // Note, that entries after |node| may become invalid during |node| doom in
+  // case when they are child entries of it. It is guaranteed that
+  // parent node will go prior to it childs in ranking list (see
+  // InternalReadSparseData and InternalWriteSparseData).
+  MemEntryImpl* last_valid = NULL;
 
   // rankings_ is ordered by last used, this will descend through the cache
   // and start dooming items before the end_time, and will stop once it reaches
   // an item used before the initial time.
-  while (next) {
-    MemEntryImpl* node = next;
-    next = rankings_.GetNext(next);
-
+  while (node) {
     if (node->GetLastUsed() < initial_time)
       break;
 
     if (node->GetLastUsed() < end_time)
       node->Doom();
+    else
+      last_valid = node;
+    node = rankings_.GetNext(last_valid);
   }
 
   return true;