Fix a potential crash by clearing callback_ before running it....

webkit/glue/resource_fetcher_unittest.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/glue/resource_fetcher.h"
 
 #include "base/callback.h"
 #include "base/message_loop.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFrame.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebURLResponse.h"
@@ skipping 28 matching lines @@
     // Start a repeating timer waiting for the download to complete.  The
     // callback has to be a static function, so we hold on to our instance.
     FetcherDelegate::instance_ = this;
     CreateTimer(kWaitIntervalMs);
   }
 
   ResourceFetcher::Callback* NewCallback() {
     return ::NewCallback(this, &FetcherDelegate::OnURLFetchComplete);
   }
 
-  void OnURLFetchComplete(const WebURLResponse& response,
-                          const std::string& data) {
+  virtual void OnURLFetchComplete(const WebURLResponse& response,
+                                  const std::string& data) {
     response_ = response;
     data_ = data;
     completed_ = true;
     DestroyTimer();
     MessageLoop::current()->Quit();
   }
 
   bool completed() const { return completed_; }
   bool timed_out() const { return time_elapsed_ms_ > kMaxWaitTimeMs; }
 
@@ skipping 155 matching lines @@
   delegate->WaitForResponse();
 
   // When we timeout, we still call the Delegate callback but we pass in empty
   // values.
   EXPECT_TRUE(delegate->completed());
   EXPECT_TRUE(delegate->response().isNull());
   EXPECT_EQ(delegate->data(), std::string());
   EXPECT_TRUE(delegate->time_elapsed_ms() < kMaxWaitTimeMs);
 }
 
+class EvilFetcherDelegate : public FetcherDelegate {
+ public:
+  void SetFetcher(ResourceFetcher* fetcher) {
+    fetcher_.reset(fetcher);
+  }
+
+  void OnURLFetchComplete(const WebURLResponse& response,
+                          const std::string& data) {
+    // Destroy the ResourceFetcher here.  We are testing that upon returning
+    // to the ResourceFetcher that it does not crash.
+    fetcher_.reset();
+    FetcherDelegate::OnURLFetchComplete(response, data);
+  }
+
+ private:
+  scoped_ptr<ResourceFetcher> fetcher_;
+};
+
+TEST_F(ResourceFetcherTests, ResourceFetcherDeletedInCallback) {
+  ASSERT_TRUE(test_server_.Start());
+
+  WebFrame* frame = test_shell_->webView()->mainFrame();
+
+  // Grab a page that takes at least 1 sec to respond, but set the fetcher to
+  // timeout in 0 sec.
+  GURL url(test_server_.GetURL("slow?1"));
+  scoped_ptr<EvilFetcherDelegate> delegate(new EvilFetcherDelegate);
+  scoped_ptr<ResourceFetcher> fetcher(new ResourceFetcherWithTimeout(
+      url, frame, 0, delegate->NewCallback()));
+  delegate->SetFetcher(fetcher.release());
+
+  delegate->WaitForResponse();
+}
+
 }  // namespace