Fix crashes in MemoryCache related to successful revalidation

Source/core/fetch/MemoryCache.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
     version 2 of the License, or (at your option) any later version.
@@ skipping 309 matching lines @@
 {
     unsigned accessCount = std::max(entry->m_resource->accessCount(), 1U);
     unsigned queueIndex = WTF::fastLog2(entry->m_resource->size() / accessCount);
     if (m_allResources.size() <= queueIndex)
         m_allResources.grow(queueIndex + 1);
     return &m_allResources[queueIndex];
 }
 
 void MemoryCache::removeFromLRUList(Resource* resource)
 {
-    // If we've never been accessed, then we're brand new and not in any list.
-    if (!resource->accessCount())
-        return;
-
     MemoryCacheEntry* entry = m_resources.get(resource->url());
     ASSERT(entry->m_resource == resource);
+
     LRUList* list = lruListFor(entry);
+    MemoryCacheEntry* next = entry->m_nextInAllResourcesList;
+    MemoryCacheEntry* previous = entry->m_previousInAllResourcesList;
+    if (!next && !previous && list->m_head != entry)
+        return;
 
 #if !ASSERT_DISABLED
     // Verify that we are in fact in this list.
     bool found = false;
     for (MemoryCacheEntry* current = list->m_head; current; current = current->m_nextInAllResourcesList) {
         if (current == entry) {
             found = true;
             break;
         }
     }
     ASSERT(found);
 #endif
 
-    MemoryCacheEntry* next = entry->m_nextInAllResourcesList;
-    MemoryCacheEntry* previous = entry->m_previousInAllResourcesList;
-
     entry->m_nextInAllResourcesList = 0;
     entry->m_previousInAllResourcesList = 0;
 
     if (next)
         next->m_previousInAllResourcesList = previous;
     else
         list->m_tail = previous;
 
     if (previous)
         previous->m_nextInAllResourcesList = next;
     else
         list->m_head = next;
 }
 
 void MemoryCache::insertInLRUList(Resource* resource)
 {
     MemoryCacheEntry* entry = m_resources.get(resource->url());
     ASSERT(entry->m_resource == resource);
 
     // Make sure we aren't in some list already.
     ASSERT(!entry->m_nextInAllResourcesList && !entry->m_previousInAllResourcesList);
     ASSERT(resource->inCache());
-    ASSERT(resource->accessCount() > 0);
 
     LRUList* list = lruListFor(entry);
 
     entry->m_nextInAllResourcesList = list->m_head;
     if (list->m_head)
         list->m_head->m_previousInAllResourcesList = entry;
     list->m_head = entry;
 
     if (!entry->m_nextInAllResourcesList)
         list->m_tail = entry;
@@ skipping 296 matching lines @@
                 printf("(%.1fK, %.1fK, %uA, %dR, %d, %d); ", current->decodedSize() / 1024.0f, (current->encodedSize() + current->overheadSize()) / 1024.0f, current->accessCount(), current->hasClients(), current->isPurgeable(), current->wasPurged());
 
             current = prev;
         }
     }
 }
 
 #endif // MEMORY_CACHE_STATS
 
 } // namespace WebCore