Code: void MemBackendImpl::EvictIfNeeded() {
  if (current_size_ <= max_size_)
    return;

  int target_size = std::max(0, max_size_ - kDefaultEvictionSize);

   base::LinkNode<MemEntryImpl>* entry = lru_list_.head();
   while (current_size_ > target_size && entry != lru_list_.end()) {
     MemEntryImpl* to_doom = entry->value();
    entry = entry->next();
     if (!to_doom->InUse())
       to_doom->Doom();
   }
}

Commit Message: [MemCache] Fix bug while iterating LRU list in eviction

It was possible to reanalyze a previously doomed entry.

Bug: 827492
Change-Id: I5d34d2ae87c96e0d2099e926e6eb2c1b30b01d63
Reviewed-on: https://chromium-review.googlesource.com/987919
Commit-Queue: Josh Karlin <jkarlin@chromium.org>
Reviewed-by: Maks Orlovich <morlovich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#547236}
CWE ID: CWE-416
void MemBackendImpl::EvictIfNeeded() {
  if (current_size_ <= max_size_)
    return;

  int target_size = std::max(0, max_size_ - kDefaultEvictionSize);

   base::LinkNode<MemEntryImpl>* entry = lru_list_.head();
   while (current_size_ > target_size && entry != lru_list_.end()) {
     MemEntryImpl* to_doom = entry->value();

    do {
      entry = entry->next();
      // It's possible that entry now points to a child of to_doom, and the
      // parent is about to be deleted. Skip past any child entries.
    } while (entry != lru_list_.end() && entry->value()->parent() == to_doom);

     if (!to_doom->InUse())
       to_doom->Doom();
   }
}
