From 29a23b83058f25942b68a6d25ef14da90be156b9 Mon Sep 17 00:00:00 2001
From: Tsuyoshi Horo <horo@chromium.org>
Date: Mon, 25 May 2026 03:28:33 -0700
Subject: [PATCH] net/disk_cache/sql: Add cache key check to DoomEntry

This CL adds a `cache_key=?` predicate to the
`kDoomEntry_MarkDoomedResources` query in the SQL disk cache backend.
Previously, the fast path for dooming entries relied solely on the
32-bit `base::PersistentHash` of the key, which could lead to unintended
entries being marked as doomed. We now bind and check the full
`cache_key` when resolving by `res_id`.

Fixed: 513383891
Change-Id: I1198eba8d82549cf5cee86f4c3153ba758adcc03
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7868351
Commit-Queue: Tsuyoshi Horo <horo@chromium.org>
Reviewed-by: Mingyu Lei <leimy@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1635659}
---

diff --git a/net/disk_cache/sql/sql_persistent_store_backend.cc b/net/disk_cache/sql/sql_persistent_store_backend.cc
index 2678c62..366773f 100644
--- a/net/disk_cache/sql/sql_persistent_store_backend.cc
+++ b/net/disk_cache/sql/sql_persistent_store_backend.cc
@@ -685,7 +685,7 @@
                      });
   base::ElapsedTimer timer;
   bool corruption_detected = false;
-  auto result = DoomEntryInternal(res_id, corruption_detected);
+  auto result = DoomEntryInternal(key, res_id, corruption_detected);
   RecordTimeAndErrorResultHistogram("DoomEntry", posting_delay, timer.Elapsed(),
                                     result, corruption_detected);
   TRACE_EVENT_END1("disk_cache", "SqlBackend.DoomEntry", "result",
@@ -699,6 +699,7 @@
 }
 
 Error SqlPersistentStore::Backend::DoomEntryInternal(
+    const CacheEntryKey& key,
     ResId res_id,
     bool& corruption_detected) {
   if (auto db_error = CheckDatabaseStatus(); db_error != Error::kOk) {
@@ -717,6 +718,7 @@
     sql::Statement statement(db_.GetCachedStatement(
         SQL_FROM_HERE, GetQuery(Query::kDoomEntry_MarkDoomedResources)));
     statement.BindInt64(0, res_id.value());
+    statement.BindString(1, key.string());
     // Iterate through the rows returned by the RETURNING clause.
     while (statement.Step()) {
       // Since we're dooming an entry, its size is subtracted from the total.
diff --git a/net/disk_cache/sql/sql_persistent_store_backend.h b/net/disk_cache/sql/sql_persistent_store_backend.h
index f1596f3..cf815b8 100644
--- a/net/disk_cache/sql/sql_persistent_store_backend.h
+++ b/net/disk_cache/sql/sql_persistent_store_backend.h
@@ -224,7 +224,9 @@
                                        base::Time creation_time,
                                        bool run_existance_check,
                                        bool& corruption_detected);
-  Error DoomEntryInternal(ResId res_id, bool& corruption_detected);
+  Error DoomEntryInternal(const CacheEntryKey& key,
+                          ResId res_id,
+                          bool& corruption_detected);
   Error DeleteDoomedEntryInternal(ResId res_id);
   Error DeleteDoomedEntriesInternal(const ResIdList& res_ids_to_delete,
                                     bool& corruption_detected);
diff --git a/net/disk_cache/sql/sql_persistent_store_queries.h b/net/disk_cache/sql/sql_persistent_store_queries.h
index 974da35..9e5f9b2 100644
--- a/net/disk_cache/sql/sql_persistent_store_queries.h
+++ b/net/disk_cache/sql/sql_persistent_store_queries.h
@@ -128,7 +128,8 @@
     "SET "
         "doomed=1 "
     "WHERE "
-        "res_id=? AND "  // 0
+        "res_id=? AND "      // 0
+        "cache_key=? AND "   // 1
         "doomed=0 "
     "RETURNING "
         "bytes_usage";       // 0