Add an experimental permissions API for extensions.

chrome/common/extensions/extension_permission_set_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/extension_permission_set.h"
 
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/common/chrome_paths.h"
@@ skipping 134 matching lines @@
   hosted_perms.insert(ExtensionAPIPermission::kBackground);
   hosted_perms.insert(ExtensionAPIPermission::kClipboardRead);
   hosted_perms.insert(ExtensionAPIPermission::kClipboardWrite);
   hosted_perms.insert(ExtensionAPIPermission::kChromeAuthPrivate);
   hosted_perms.insert(ExtensionAPIPermission::kChromePrivate);
   hosted_perms.insert(ExtensionAPIPermission::kExperimental);
   hosted_perms.insert(ExtensionAPIPermission::kGeolocation);
   hosted_perms.insert(ExtensionAPIPermission::kNotification);
   hosted_perms.insert(ExtensionAPIPermission::kUnlimitedStorage);
   hosted_perms.insert(ExtensionAPIPermission::kWebstorePrivate);
+  hosted_perms.insert(ExtensionAPIPermission::kPermissions);
 
   ExtensionAPIPermissionSet perms = info->GetAll();
   size_t count = 0;
   for (ExtensionAPIPermissionSet::iterator i = perms.begin();
        i != perms.end(); ++i) {
     count += hosted_perms.count(*i);
     EXPECT_EQ(hosted_perms.count(*i) > 0, info->GetByID(*i)->is_hosted_app());
   }
 
-  EXPECT_EQ(10u, count);
-  EXPECT_EQ(10u, info->get_hosted_app_permission_count());
+  EXPECT_EQ(hosted_perms.size(), count);
+  EXPECT_EQ(hosted_perms.size(), info->get_hosted_app_permission_count());
 }
 
 TEST(ExtensionAPIPermissionTest, ComponentOnlyPermissions) {
   ExtensionPermissionsInfo* info = ExtensionPermissionsInfo::GetInstance();
   ExtensionAPIPermissionSet private_perms;
   private_perms.insert(ExtensionAPIPermission::kChromeAuthPrivate);
   private_perms.insert(ExtensionAPIPermission::kChromeosInfoPrivate);
   private_perms.insert(ExtensionAPIPermission::kFileBrowserPrivate);
   private_perms.insert(ExtensionAPIPermission::kMediaPlayerPrivate);
   private_perms.insert(ExtensionAPIPermission::kWebstorePrivate);
 
   ExtensionAPIPermissionSet perms = info->GetAll();
   int count = 0;
   for (ExtensionAPIPermissionSet::iterator i = perms.begin();
        i != perms.end(); ++i) {
     count += private_perms.count(*i);
     EXPECT_EQ(private_perms.count(*i) > 0,
               info->GetByID(*i)->is_component_only());
   }
 
   EXPECT_EQ(5, count);
 }
 
 TEST(ExtensionPermissionSetTest, EffectiveHostPermissions) {
   scoped_refptr<Extension> extension;
-  const ExtensionPermissionSet* permissions = NULL;
+  scoped_refptr<const ExtensionPermissionSet> permissions;
 
   extension = LoadManifest("effective_host_permissions", "empty.json");
-  permissions = extension->permission_set();
+  permissions = extension->GetActivePermissions();
   EXPECT_EQ(0u, extension->GetEffectiveHostPermissions().patterns().size());
   EXPECT_FALSE(permissions->HasEffectiveAccessToURL(
       GURL("http://www.google.com")));
   EXPECT_FALSE(permissions->HasEffectiveAccessToAllHosts());
 
   extension = LoadManifest("effective_host_permissions", "one_host.json");
-  permissions = extension->permission_set();
+  permissions = extension->GetActivePermissions();
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(
       GURL("http://www.google.com")));
   EXPECT_FALSE(permissions->HasEffectiveAccessToURL(
       GURL("https://www.google.com")));
   EXPECT_FALSE(permissions->HasEffectiveAccessToAllHosts());
 
   extension = LoadManifest("effective_host_permissions",
                            "one_host_wildcard.json");
-  permissions = extension->permission_set();
+  permissions = extension->GetActivePermissions();
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(GURL("http://google.com")));
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(
       GURL("http://foo.google.com")));
   EXPECT_FALSE(permissions->HasEffectiveAccessToAllHosts());
 
   extension = LoadManifest("effective_host_permissions", "two_hosts.json");
-  permissions = extension->permission_set();
+  permissions = extension->GetActivePermissions();
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(
       GURL("http://www.google.com")));
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(
       GURL("http://www.reddit.com")));
   EXPECT_FALSE(permissions->HasEffectiveAccessToAllHosts());
 
   extension = LoadManifest("effective_host_permissions",
                            "https_not_considered.json");
-  permissions = extension->permission_set();
+  permissions = extension->GetActivePermissions();
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(GURL("http://google.com")));
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(GURL("https://google.com")));
   EXPECT_FALSE(permissions->HasEffectiveAccessToAllHosts());
 
   extension = LoadManifest("effective_host_permissions",
                            "two_content_scripts.json");
-  permissions = extension->permission_set();
+  permissions = extension->GetActivePermissions();
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(GURL("http://google.com")));
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(
       GURL("http://www.reddit.com")));
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(
       GURL("http://news.ycombinator.com")));
   EXPECT_FALSE(permissions->HasEffectiveAccessToAllHosts());
 
   extension = LoadManifest("effective_host_permissions", "all_hosts.json");
-  permissions = extension->permission_set();
+  permissions = extension->GetActivePermissions();
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(GURL("http://test/")));
   EXPECT_FALSE(permissions->HasEffectiveAccessToURL(GURL("https://test/")));
   EXPECT_TRUE(
       permissions->HasEffectiveAccessToURL(GURL("http://www.google.com")));
   EXPECT_TRUE(permissions->HasEffectiveAccessToAllHosts());
 
   extension = LoadManifest("effective_host_permissions", "all_hosts2.json");
-  permissions = extension->permission_set();
+  permissions = extension->GetActivePermissions();
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(GURL("http://test/")));
   EXPECT_TRUE(
       permissions->HasEffectiveAccessToURL(GURL("http://www.google.com")));
   EXPECT_TRUE(permissions->HasEffectiveAccessToAllHosts());
 
   extension = LoadManifest("effective_host_permissions", "all_hosts3.json");
-  permissions = extension->permission_set();
+  permissions = extension->GetActivePermissions();
   EXPECT_FALSE(permissions->HasEffectiveAccessToURL(GURL("http://test/")));
   EXPECT_TRUE(permissions->HasEffectiveAccessToURL(GURL("https://test/")));
   EXPECT_TRUE(
       permissions->HasEffectiveAccessToURL(GURL("http://www.google.com")));
   EXPECT_TRUE(permissions->HasEffectiveAccessToAllHosts());
 }
 
 TEST(ExtensionPermissionSetTest, ExplicitAccessToOrigin) {
   ExtensionAPIPermissionSet apis;
   URLPatternSet explicit_hosts;
@@ skipping 43 matching lines @@
 
   AddPattern(&explicit_hosts1, "http://*.google.com/*");
   AddPattern(&expected_explicit_hosts, "http://*.google.com/*");
   AddPattern(&effective_hosts, "http://*.google.com/*");
 
   set1.reset(new ExtensionPermissionSet(
       apis1, explicit_hosts1, scriptable_hosts1));
   set2.reset(new ExtensionPermissionSet(
       apis2, explicit_hosts2, scriptable_hosts2));
   union_set.reset(ExtensionPermissionSet::CreateUnion(set1.get(), set2.get()));
+  EXPECT_TRUE(set1->Contains(*set2));
+  EXPECT_TRUE(set1->Contains(*union_set));
+  EXPECT_FALSE(set2->Contains(*set1));
+  EXPECT_FALSE(set2->Contains(*union_set));
+  EXPECT_TRUE(union_set->Contains(*set1));
+  EXPECT_TRUE(union_set->Contains(*set2));
 
   EXPECT_FALSE(union_set->HasEffectiveFullAccess());
   EXPECT_EQ(expected_apis, union_set->apis());
   EXPECT_EQ(expected_explicit_hosts, union_set->explicit_hosts());
   EXPECT_EQ(expected_scriptable_hosts, union_set->scriptable_hosts());
   EXPECT_EQ(expected_explicit_hosts, union_set->effective_hosts());
 
   // Now use a real second set.
   apis2.insert(ExtensionAPIPermission::kTab);
   apis2.insert(ExtensionAPIPermission::kProxy);
   apis2.insert(ExtensionAPIPermission::kClipboardWrite);
   apis2.insert(ExtensionAPIPermission::kPlugin);
   expected_apis.insert(ExtensionAPIPermission::kTab);
   expected_apis.insert(ExtensionAPIPermission::kProxy);
   expected_apis.insert(ExtensionAPIPermission::kClipboardWrite);
   expected_apis.insert(ExtensionAPIPermission::kPlugin);
 
   AddPattern(&explicit_hosts2, "http://*.example.com/*");
   AddPattern(&scriptable_hosts2, "http://*.google.com/*");
   AddPattern(&expected_explicit_hosts, "http://*.example.com/*");
   AddPattern(&expected_scriptable_hosts, "http://*.google.com/*");
 
   effective_hosts.ClearPatterns();
   AddPattern(&effective_hosts, "<all_urls>");
 
   set2.reset(new ExtensionPermissionSet(
       apis2, explicit_hosts2, scriptable_hosts2));
   union_set.reset(ExtensionPermissionSet::CreateUnion(set1.get(), set2.get()));
+
+  EXPECT_FALSE(set1->Contains(*set2));
+  EXPECT_FALSE(set1->Contains(*union_set));
+  EXPECT_FALSE(set2->Contains(*set1));
+  EXPECT_FALSE(set2->Contains(*union_set));
+  EXPECT_TRUE(union_set->Contains(*set1));
+  EXPECT_TRUE(union_set->Contains(*set2));
+
   EXPECT_TRUE(union_set->HasEffectiveFullAccess());
   EXPECT_TRUE(union_set->HasEffectiveAccessToAllHosts());
   EXPECT_EQ(expected_apis, union_set->apis());
   EXPECT_EQ(expected_explicit_hosts, union_set->explicit_hosts());
   EXPECT_EQ(expected_scriptable_hosts, union_set->scriptable_hosts());
   EXPECT_EQ(effective_hosts, union_set->effective_hosts());
 }
 
+TEST(ExtensionPermissionSetTest, CreateIntersection) {
+  ExtensionAPIPermissionSet apis1;
+  ExtensionAPIPermissionSet apis2;
+  ExtensionAPIPermissionSet expected_apis;
+
+  URLPatternSet explicit_hosts1;
+  URLPatternSet explicit_hosts2;
+  URLPatternSet expected_explicit_hosts;
+
+  URLPatternSet scriptable_hosts1;
+  URLPatternSet scriptable_hosts2;
+  URLPatternSet expected_scriptable_hosts;
+
+  URLPatternSet effective_hosts;
+
+  scoped_ptr<ExtensionPermissionSet> set1;
+  scoped_ptr<ExtensionPermissionSet> set2;
+  scoped_ptr<ExtensionPermissionSet> new_set;
+
+  // Intersection with an empty set.
+  apis1.insert(ExtensionAPIPermission::kTab);
+  apis1.insert(ExtensionAPIPermission::kBackground);
+
+  AddPattern(&explicit_hosts1, "http://*.google.com/*");
+  AddPattern(&scriptable_hosts1, "http://www.reddit.com/*");
+
+  set1.reset(new ExtensionPermissionSet(
+      apis1, explicit_hosts1, scriptable_hosts1));
+  set2.reset(new ExtensionPermissionSet(
+      apis2, explicit_hosts2, scriptable_hosts2));
+  new_set.reset(
+      ExtensionPermissionSet::CreateIntersection(set1.get(), set2.get()));
+  EXPECT_TRUE(set1->Contains(*new_set));
+  EXPECT_TRUE(set2->Contains(*new_set));
+  EXPECT_TRUE(set1->Contains(*set2));
+  EXPECT_FALSE(set2->Contains(*set1));
+  EXPECT_FALSE(new_set->Contains(*set1));
+  EXPECT_TRUE(new_set->Contains(*set2));
+
+  EXPECT_TRUE(new_set->IsEmpty());
+  EXPECT_FALSE(new_set->HasEffectiveFullAccess());
+  EXPECT_EQ(expected_apis, new_set->apis());
+  EXPECT_EQ(expected_explicit_hosts, new_set->explicit_hosts());
+  EXPECT_EQ(expected_scriptable_hosts, new_set->scriptable_hosts());
+  EXPECT_EQ(expected_explicit_hosts, new_set->effective_hosts());
+
+  // Now use a real second set.
+  apis2.insert(ExtensionAPIPermission::kTab);
+  apis2.insert(ExtensionAPIPermission::kProxy);
+  apis2.insert(ExtensionAPIPermission::kClipboardWrite);
+  apis2.insert(ExtensionAPIPermission::kPlugin);
+  expected_apis.insert(ExtensionAPIPermission::kTab);
+
+  AddPattern(&explicit_hosts2, "http://*.example.com/*");
+  AddPattern(&explicit_hosts2, "http://*.google.com/*");
+  AddPattern(&scriptable_hosts2, "http://*.google.com/*");
+  AddPattern(&expected_explicit_hosts, "http://*.google.com/*");
+
+  effective_hosts.ClearPatterns();
+  AddPattern(&effective_hosts, "http://*.google.com/*");
+
+  set2.reset(new ExtensionPermissionSet(
+      apis2, explicit_hosts2, scriptable_hosts2));
+  new_set.reset(
+      ExtensionPermissionSet::CreateIntersection(set1.get(), set2.get()));
+
+  EXPECT_TRUE(set1->Contains(*new_set));
+  EXPECT_TRUE(set2->Contains(*new_set));
+  EXPECT_FALSE(set1->Contains(*set2));
+  EXPECT_FALSE(set2->Contains(*set1));
+  EXPECT_FALSE(new_set->Contains(*set1));
+  EXPECT_FALSE(new_set->Contains(*set2));
+
+  EXPECT_FALSE(new_set->HasEffectiveFullAccess());
+  EXPECT_FALSE(new_set->HasEffectiveAccessToAllHosts());
+  EXPECT_EQ(expected_apis, new_set->apis());
+  EXPECT_EQ(expected_explicit_hosts, new_set->explicit_hosts());
+  EXPECT_EQ(expected_scriptable_hosts, new_set->scriptable_hosts());
+  EXPECT_EQ(effective_hosts, new_set->effective_hosts());
+}
+
+TEST(ExtensionPermissionSetTest, CreateDifference) {
+  ExtensionAPIPermissionSet apis1;
+  ExtensionAPIPermissionSet apis2;
+  ExtensionAPIPermissionSet expected_apis;
+
+  URLPatternSet explicit_hosts1;
+  URLPatternSet explicit_hosts2;
+  URLPatternSet expected_explicit_hosts;
+
+  URLPatternSet scriptable_hosts1;
+  URLPatternSet scriptable_hosts2;
+  URLPatternSet expected_scriptable_hosts;
+
+  URLPatternSet effective_hosts;
+
+  scoped_ptr<ExtensionPermissionSet> set1;
+  scoped_ptr<ExtensionPermissionSet> set2;
+  scoped_ptr<ExtensionPermissionSet> new_set;
+
+  // Difference with an empty set.
+  apis1.insert(ExtensionAPIPermission::kTab);
+  apis1.insert(ExtensionAPIPermission::kBackground);
+
+  AddPattern(&explicit_hosts1, "http://*.google.com/*");
+  AddPattern(&scriptable_hosts1, "http://www.reddit.com/*");
+
+  set1.reset(new ExtensionPermissionSet(
+      apis1, explicit_hosts1, scriptable_hosts1));
+  set2.reset(new ExtensionPermissionSet(
+      apis2, explicit_hosts2, scriptable_hosts2));
+  new_set.reset(
+      ExtensionPermissionSet::CreateDifference(set1.get(), set2.get()));
+  EXPECT_EQ(*set1, *new_set);
+
+  // Now use a real second set.
+  apis2.insert(ExtensionAPIPermission::kTab);
+  apis2.insert(ExtensionAPIPermission::kProxy);
+  apis2.insert(ExtensionAPIPermission::kClipboardWrite);
+  apis2.insert(ExtensionAPIPermission::kPlugin);
+  expected_apis.insert(ExtensionAPIPermission::kBackground);
+
+  AddPattern(&explicit_hosts2, "http://*.example.com/*");
+  AddPattern(&explicit_hosts2, "http://*.google.com/*");
+  AddPattern(&scriptable_hosts2, "http://*.google.com/*");
+  AddPattern(&expected_scriptable_hosts, "http://www.reddit.com/*");
+
+  effective_hosts.ClearPatterns();
+  AddPattern(&effective_hosts, "http://www.reddit.com/*");
+
+  set2.reset(new ExtensionPermissionSet(
+      apis2, explicit_hosts2, scriptable_hosts2));
+  new_set.reset(
+      ExtensionPermissionSet::CreateDifference(set1.get(), set2.get()));
+
+  EXPECT_TRUE(set1->Contains(*new_set));
+  EXPECT_FALSE(set2->Contains(*new_set));
+
+  EXPECT_FALSE(new_set->HasEffectiveFullAccess());
+  EXPECT_FALSE(new_set->HasEffectiveAccessToAllHosts());
+  EXPECT_EQ(expected_apis, new_set->apis());
+  EXPECT_EQ(expected_explicit_hosts, new_set->explicit_hosts());
+  EXPECT_EQ(expected_scriptable_hosts, new_set->scriptable_hosts());
+  EXPECT_EQ(effective_hosts, new_set->effective_hosts());
+
+  // |set3| = |set1| - |set2| --> |set3| intersect |set2| == empty_set
+  set1.reset(
+      ExtensionPermissionSet::CreateIntersection(new_set.get(), set2.get()));
+  EXPECT_TRUE(set1->IsEmpty());
+}
+
 TEST(ExtensionPermissionSetTest, HasLessPrivilegesThan) {
   const struct {
     const char* base_name;
     // Increase these sizes if you have more than 10.
     const char* granted_apis[10];
     const char* granted_hosts[10];
     bool full_access;
     bool expect_increase;
   } kTests[] = {
     { "allhosts1", {NULL}, {"http://*/", NULL}, false,
@@ skipping 61 matching lines @@
     }
 
     URLPatternSet granted_hosts;
     for (size_t j = 0; kTests[i].granted_hosts[j] != NULL; ++j)
       AddPattern(&granted_hosts, kTests[i].granted_hosts[j]);
 
     EXPECT_TRUE(new_extension.get()) << kTests[i].base_name << "_new.json";
     if (!new_extension.get())
       continue;
 
-    const ExtensionPermissionSet* old_p = old_extension->permission_set();
-    const ExtensionPermissionSet* new_p = new_extension->permission_set();
+    const ExtensionPermissionSet* old_p =
+        old_extension->GetActivePermissions();
+    const ExtensionPermissionSet* new_p =
+        new_extension->GetActivePermissions();
 
     EXPECT_EQ(kTests[i].expect_increase, old_p->HasLessPrivilegesThan(new_p))
         << kTests[i].base_name;
   }
 }
 
 TEST(ExtensionPermissionSetTest, PermissionMessages) {
   // Ensure that all permissions that needs to show install UI actually have
   // strings associated with them.
   ExtensionAPIPermissionSet skip;
@@ skipping 33 matching lines @@
   skip.insert(ExtensionAPIPermission::kFileBrowserPrivate);
   skip.insert(ExtensionAPIPermission::kMediaPlayerPrivate);
   skip.insert(ExtensionAPIPermission::kChromeAuthPrivate);
   skip.insert(ExtensionAPIPermission::kChromePrivate);
   skip.insert(ExtensionAPIPermission::kChromeosInfoPrivate);
   skip.insert(ExtensionAPIPermission::kWebSocketProxyPrivate);
   skip.insert(ExtensionAPIPermission::kInputMethodPrivate);
 
   // Warned as part of host permissions.
   skip.insert(ExtensionAPIPermission::kDevtools);
+
+  // This will warn users later, when they request new permissions.
+  skip.insert(ExtensionAPIPermission::kPermissions);
+
   ExtensionPermissionsInfo* info = ExtensionPermissionsInfo::GetInstance();
   ExtensionAPIPermissionSet permissions = info->GetAll();
   for (ExtensionAPIPermissionSet::const_iterator i = permissions.begin();
        i != permissions.end(); ++i) {
     ExtensionAPIPermission* permission = info->GetByID(*i);
     EXPECT_TRUE(permission);
     if (skip.count(*i)) {
       EXPECT_EQ(ExtensionPermissionMessage::kNone, permission->message_id())
           << "unexpected message_id for " << permission->name();
     } else {
@@ skipping 39 matching lines @@
     EXPECT_EQ(kTests[i].expect_success,
               permissions.HasAccessToFunction(kTests[i].permission_name));
   }
 }
 
 TEST(ExtensionPermissionSetTest, GetWarningMessages_ManyHosts) {
   scoped_refptr<Extension> extension;
 
   extension = LoadManifest("permissions", "many-hosts.json");
   std::vector<string16> warnings =
-      extension->permission_set()->GetWarningMessages();
+      extension->GetActivePermissions()->GetWarningMessages();
   ASSERT_EQ(1u, warnings.size());
   EXPECT_EQ("Your data on encrypted.google.com and www.google.com",
             UTF16ToUTF8(warnings[0]));
 }
 
 TEST(ExtensionPermissionSetTest, GetWarningMessages_Plugins) {
   scoped_refptr<Extension> extension;
   scoped_ptr<ExtensionPermissionSet> permissions;
 
   extension = LoadManifest("permissions", "plugins.json");
   std::vector<string16> warnings =
-      extension->permission_set()->GetWarningMessages();
+      extension->GetActivePermissions()->GetWarningMessages();
   // We don't parse the plugins key on Chrome OS, so it should not ask for any
   // permissions.
 #if defined(OS_CHROMEOS)
   ASSERT_EQ(0u, warnings.size());
 #else
   ASSERT_EQ(1u, warnings.size());
   EXPECT_EQ("All data on your computer and the websites you visit",
             UTF16ToUTF8(warnings[0]));
 #endif
 }
@@ skipping 320 matching lines @@
   // and we can convert it back to the id set.
   EXPECT_EQ(4u, api_names.size());
   EXPECT_EQ(apis,
             ExtensionPermissionsInfo::GetInstance()->GetAllByName(api_names));
 }
 
 TEST(ExtensionPermissionSetTest, IsEmpty) {
   ExtensionAPIPermissionSet empty_apis;
   URLPatternSet empty_extent;
 
-  ExtensionPermissionSet perm_set;
-  EXPECT_TRUE(perm_set.IsEmpty());
+  ExtensionPermissionSet empty_set;
+  EXPECT_TRUE(empty_set.IsEmpty());
+  scoped_ptr<ExtensionPermissionSet> perm_set;
 
-  perm_set = ExtensionPermissionSet(empty_apis, empty_extent, empty_extent);
-  EXPECT_TRUE(perm_set.IsEmpty());
+  perm_set.reset(new ExtensionPermissionSet(
+      empty_apis, empty_extent, empty_extent));
+  EXPECT_TRUE(perm_set->IsEmpty());
 
   ExtensionAPIPermissionSet non_empty_apis;
   non_empty_apis.insert(ExtensionAPIPermission::kBackground);
-  perm_set = ExtensionPermissionSet(
-      non_empty_apis, empty_extent, empty_extent);
-  EXPECT_FALSE(perm_set.IsEmpty());
+  perm_set.reset(new ExtensionPermissionSet(
+      non_empty_apis, empty_extent, empty_extent));
+  EXPECT_FALSE(perm_set->IsEmpty());
 
   // Try non standard host
   URLPatternSet non_empty_extent;
   AddPattern(&non_empty_extent, "http://www.google.com/*");
 
-  perm_set = ExtensionPermissionSet(
-      empty_apis, non_empty_extent, empty_extent);
-  EXPECT_FALSE(perm_set.IsEmpty());
+  perm_set.reset(new ExtensionPermissionSet(
+      empty_apis, non_empty_extent, empty_extent));
+  EXPECT_FALSE(perm_set->IsEmpty());
 
-  perm_set = ExtensionPermissionSet(
-      empty_apis, empty_extent, non_empty_extent);
-  EXPECT_FALSE(perm_set.IsEmpty());
+  perm_set.reset(new ExtensionPermissionSet(
+      empty_apis, empty_extent, non_empty_extent));
+  EXPECT_FALSE(perm_set->IsEmpty());
 }