Add guard for crash in MemoryCache::pruneDeadResources

third_party/WebKit/Source/core/fetch/MemoryCache.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
     version 2 of the License, or (at your option) any later version.
@@ skipping 281 matching lines @@
         // Remove from the tail, since this is the least frequently accessed of the objects.
         MemoryCacheEntry* current = m_allResources[i].m_tail;
 
         // First flush all the decoded data in this queue.
         while (current) {
             MemoryCacheEntry* previous = current->m_previousInAllResourcesList;
             if (previous) {
                 ASSERT(previous->m_resource);
                 ASSERT(contains(previous->m_resource.get()));
             }
-            if (!current->m_resource->hasClients() && !current->m_resource->isPreloaded() && current->m_resource->isLoaded()) {
+            // TODO(leon.han@intel.com): We shouldn't be hitting the case
+            // that current->m_resource is null here, would turn the case into
+            // ASSERT(current->m_resource) after crbug.com/594644 got resolved.
+            if (current->m_resource && !current->m_resource->hasClients() && !current->m_resource->isPreloaded() && current->m_resource->isLoaded()) {
                 // Destroy our decoded data. This will remove us from
                 // m_liveDecodedResources, and possibly move us to a different
                 // LRU list in m_allResources.
                 current->m_resource->prune();
 
                 if (targetSize && m_deadSize <= targetSize)
                     return;
             }
             // Decoded data may reference other resources. Stop iterating if 'previous' somehow got
             // kicked out of cache during destroyDecodedData().
             if (!previous || !previous->m_resource || !contains(previous->m_resource.get()))
                 break;
             current = previous;
         }
 
         // Now evict objects from this queue.
         current = m_allResources[i].m_tail;
         while (current) {
             MemoryCacheEntry* previous = current->m_previousInAllResourcesList;
             if (previous) {
                 ASSERT(previous->m_resource);
                 ASSERT(contains(previous->m_resource.get()));
             }
-            if (!current->m_resource->hasClients() && !current->m_resource->isPreloaded()) {
+            // TODO(leon.han@intel.com): We shouldn't be hitting the case
+            // that current->m_resource is null here, would turn the case into
+            // ASSERT(current->m_resource) after crbug.com/594644 got resolved.
+            if (current->m_resource && !current->m_resource->hasClients() && !current->m_resource->isPreloaded()) {
                 evict(current);
                 if (targetSize && m_deadSize <= targetSize)
                     return;
             }
             if (!previous || !previous->m_resource || !contains(previous->m_resource.get()))
                 break;
             current = previous;
         }
 
         // Shrink the vector back down so we don't waste time inspecting
@@ skipping 434 matching lines @@
                 printf("(%.1fK, %.1fK, %uA, %dR, %d); ", currentResource->decodedSize() / 1024.0f, (currentResource->encodedSize() + currentResource->overheadSize()) / 1024.0f, current->m_accessCount, currentResource->hasClients(), currentResource->isPurgeable());
 
             current = current->m_previousInAllResourcesList;
         }
     }
 }
 
 #endif // MEMORY_CACHE_STATS
 
 } // namespace blink