DescriptionFix crash in MemoryCache::replace.
It's possible that MemoryCache::replace will try to evict a resource that has
already been evicted. If there is another resource present in its place, it
won't get evicted, but will get partially overwritten. In that partial
overwrite, we leave references to it in the LRU lists, leading to later
crashes.
BUG=357174
TEST=MemoryCacheTest.RemoveDuringRevalidation
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=170217
Patch Set 1 #
Messages
Total messages: 14 (0 generated)
|