Fix null dereference on MemoryCache.

third_party/WebKit/Source/core/fetch/MemoryCache.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
     version 2 of the License, or (at your option) any later version.
@@ skipping 336 matching lines @@
                 // Destroy our decoded data. This will remove us from
                 // m_liveDecodedResources, and possibly move us to a different
                 // LRU list in m_allResources.
                 current->m_resource->prune();
 
                 if (targetSize && m_deadSize <= targetSize)
                     return;
             }
             // Decoded data may reference other resources. Stop iterating if 'previous' somehow got
             // kicked out of cache during destroyDecodedData().
-            if (previous && !contains(previous->m_resource.get()))
+            if (!previous || !previous->m_resource || !contains(previous->m_resource.get()))
                 break;
             current = previous;
         }
 
         // Now evict objects from this queue.
         current = m_allResources[i].m_tail;
         while (current) {
             MemoryCacheEntry* previous = current->m_previousInAllResourcesList;
             ASSERT(!previous || contains(previous->m_resource.get()));
             if (!current->m_resource->hasClients() && !current->m_resource->isPreloaded()
                 && !current->m_resource->isCacheValidator() && current->m_resource->canDelete()
                 && current->m_resource->type() != Resource::MainResource) {
                 // Main Resources in the cache are only substitue data that was
                 // precached and should not be evicted.
                 bool wasEvicted = evict(current);
                 ASSERT_UNUSED(wasEvicted, wasEvicted);
                 if (targetSize && m_deadSize <= targetSize)
                     return;
             }
-            if (previous && !contains(previous->m_resource.get()))
+            if (!previous || !previous->m_resource || !contains(previous->m_resource.get()))
                 break;
             current = previous;
         }
 
         // Shrink the vector back down so we don't waste time inspecting
         // empty LRU lists on future prunes.
         if (m_allResources[i].m_head)
             canShrinkLRULists = false;
         else if (canShrinkLRULists)
             m_allResources.resize(i);
@@ skipping 398 matching lines @@
 void MemoryCache::onMemoryDump(WebMemoryDumpLevelOfDetail levelOfDetail, WebProcessMemoryDump* memoryDump)
 {
     for (const auto& resourceMapIter : m_resourceMaps) {
         for (const auto& resourceIter : *resourceMapIter.value) {
             Resource* resource = resourceIter.value->m_resource.get();
             resource->onMemoryDump(levelOfDetail, memoryDump);
         }
     }
 }
 
+bool MemoryCache::isInSameLRUListForTest(const Resource* x, const Resource* y)
+{
+    MemoryCacheEntry* ex = getEntryForResource(x);
+    MemoryCacheEntry* ey = getEntryForResource(y);
+    ASSERT(ex);
+    ASSERT(ey);
+    return lruListFor(ex->m_accessCount, x->size()) == lruListFor(ey->m_accessCount, y->size());
+}
+
 void MemoryCache::registerLiveResource(Resource& resource)
 {
 #if ENABLE(OILPAN)
     ASSERT(!m_liveResources.contains(&resource));
     m_liveResources.add(&resource);
 #endif
 }
 
 void MemoryCache::unregisterLiveResource(Resource& resource)
 {
@@ skipping 41 matching lines @@
                 printf("(%.1fK, %.1fK, %uA, %dR, %d, %d); ", currentResource->decodedSize() / 1024.0f, (currentResource->encodedSize() + currentResource->overheadSize()) / 1024.0f, current->m_accessCount, currentResource->hasClients(), currentResource->isPurgeable(), currentResource->wasPurged());
 
             current = current->m_previousInAllResourcesList;
         }
     }
 }
 
 #endif // MEMORY_CACHE_STATS
 
 } // namespace blink