Bug 133185

Summary:

[Curl] Crash when exceeding maximum cache limit.

Product:

WebKit

Reporter:

peavo

Component:

WebCore Misc.

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

alex.christensen, bfulgham, commit-queue, galpeter, mmatyas

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none
Patch	none

peavo

Reported 2014-05-22 10:53:45 PDT

When the maximum cache limit is exceeded, I get a crash. This happens when deleting cache entries, because a reference to the url string object in the LRU list is used as a parameter to invalidateCacheEntry(), when called from makeRoomForNewEntry(). When the string is removed from the LRU list in makeRoomForNewEntry(), the string is deleted. Next, the string is accessed again to remove the url from the index, and we crash. This can be fixed by removing the string from the LRU list after it is removed from the index. Fixing the crash also revealed an infinite loop problem. If the url for some reason only exist in the LRU list, and not in the index, we will inifitely loop in makeRoomForNewEntry(), trying to remove this url from the cache, but never succeeding. This can be fixed by removing the url from the LRU list, also when it's not in the index.

Attachments
Patch (2.77 KB, patch) 2014-05-22 11:03 PDT, peavo	no flags	Details Formatted Diff Diff
Patch (2.77 KB, patch) 2014-05-22 11:28 PDT, peavo	no flags	Details Formatted Diff Diff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.