[Webkit-unassigned] [Bug 133185] New: [Curl] Crash when exceeding maximum cache limit.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=133185

           Summary: [Curl] Crash when exceeding maximum cache limit.
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: peavo at outlook.com


When the maximum cache limit is exceeded, I get a crash.
This happens when deleting cache entries, because a reference to the url string object in the LRU list
is used as a parameter to invalidateCacheEntry(), when called from makeRoomForNewEntry().
When the string is removed from the LRU list in makeRoomForNewEntry(), the string is deleted.
Next, the string is accessed again to remove the url from the index, and we crash.

This can be fixed by removing the string from the LRU list after it is removed from the index.

Fixing the crash also revealed an infinite loop problem.
If the url for some reason only exist in the LRU list, and not in the index,
we will inifitely loop in makeRoomForNewEntry(), trying to remove this url from the cache, but never succeeding.
This can be fixed by removing the url from the LRU list, also when it's not in the index.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.