Fix crash in MemoryCache::replace.

Source/core/fetch/MemoryCacheTest.cpp

Index: Source/core/fetch/MemoryCacheTest.cpp
diff --git a/Source/core/fetch/MemoryCacheTest.cpp b/Source/core/fetch/MemoryCacheTest.cpp
index 3302b630755236ffca7f51d34ba981970a3b90d0..5a10bb68a41a0c35991525e6b1c7485ef00e3193 100644
--- a/Source/core/fetch/MemoryCacheTest.cpp
+++ b/Source/core/fetch/MemoryCacheTest.cpp
@@ -383,4 +383,27 @@ TEST_F(MemoryCacheTest, MultipleReplace)
     EXPECT_FALSE(memoryCache()->contains(resource2.get()));
 }
 
+TEST_F(MemoryCacheTest, RemoveDuringRevalidation)
+{
+    ResourcePtr<FakeResource> resource1 = new FakeResource(ResourceRequest(""), Resource::Raw);
+    memoryCache()->add(resource1.get());
+
+    ResourcePtr<FakeResource> resource2 = new FakeResource(ResourceRequest(""), Resource::Raw);
+    memoryCache()->remove(resource1.get());
+    memoryCache()->add(resource2.get());
+    EXPECT_TRUE(memoryCache()->contains(resource2.get()));
+    EXPECT_FALSE(memoryCache()->contains(resource1.get()));
+
+    ResourcePtr<FakeResource> resource3 = new FakeResource(ResourceRequest(""), Resource::Raw);
+    memoryCache()->remove(resource2.get());
+    memoryCache()->add(resource3.get());
+    EXPECT_TRUE(memoryCache()->contains(resource3.get()));
+    EXPECT_FALSE(memoryCache()->contains(resource2.get()));
+
+    memoryCache()->replace(resource1.get(), resource2.get());
+    EXPECT_TRUE(memoryCache()->contains(resource1.get()));
+    EXPECT_FALSE(memoryCache()->contains(resource2.get()));
+    EXPECT_FALSE(memoryCache()->contains(resource3.get()));
+}
+
 } // namespace