Fix invalid read in the ResourceTracker tests. It wasn't doing the proper

webkit/plugins/ppapi/resource_tracker_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/ppapi_unittest.h"
 
 #include "base/memory/scoped_ptr.h"
 #include "ppapi/c/pp_var.h"
 #include "ppapi/c/ppp_instance.h"
 #include "third_party/npapi/bindings/npruntime.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebBindings.h"
 #include "webkit/plugins/ppapi/mock_plugin_delegate.h"
 #include "webkit/plugins/ppapi/mock_resource.h"
 #include "webkit/plugins/ppapi/npapi_glue.h"
 #include "webkit/plugins/ppapi/npobject_var.h"
 #include "webkit/plugins/ppapi/ppapi_plugin_instance.h"
 #include "webkit/plugins/ppapi/resource_tracker.h"
 
 using ppapi::NPObjectVar;
 
 namespace webkit {
@@ skipping 16 matching lines @@
 };
 
 int TrackedMockResource::tracked_objects_alive = 0;
 
 // Tracked NPObjects -----------------------------------------------------------
 
 int g_npobjects_alive = 0;
 
 void TrackedClassDeallocate(NPObject* npobject) {
   g_npobjects_alive--;
+  delete npobject;
 }
 
 NPClass g_tracked_npclass = {
   NP_CLASS_STRUCT_VERSION,
   NULL,
   &TrackedClassDeallocate,
   NULL,
   NULL,
   NULL,
   NULL,
   NULL,
   NULL,
   NULL,
   NULL,
   NULL,
 };
 
-// Returns a new tracked NPObject with a refcount of 1.
+// Returns a new tracked NPObject with a refcount of 1. You'll want to put this
+// in a NPObjectReleaser to free this ref when the test completes.
 NPObject* NewTrackedNPObject() {
   NPObject* object = new NPObject;
   object->_class = &g_tracked_npclass;
   object->referenceCount = 1;
 
   g_npobjects_alive++;
   return object;
 }
 
+class ReleaseNPObject {
+ public:
+  void operator()(NPObject* o) const {
+    WebKit::WebBindings::releaseObject(o);
+  }
+};
+
+// Handles automatically releasing a reference to the NPObject on destruction.
+// It's assumed the input has a ref already taken.
+typedef scoped_ptr_malloc<NPObject, ReleaseNPObject> NPObjectReleaser;
+
 }  // namespace
 
 // ResourceTrackerTest ---------------------------------------------------------
 
 class ResourceTrackerTest : public PpapiUnittest {
  public:
   ResourceTrackerTest() {
   }
 
   virtual void SetUp() {
@@ skipping 92 matching lines @@
 }
 
 TEST_F(ResourceTrackerTest, DeleteObjectVarWithInstance) {
   // Make a second instance (the test harness already creates & manages one).
   scoped_refptr<PluginInstance> instance2(
       PluginInstance::Create1_0(delegate(), module(),
                                 GetMockInterface(PPP_INSTANCE_INTERFACE_1_0)));
   PP_Instance pp_instance2 = instance2->pp_instance();
 
   // Make an object var.
-  scoped_ptr<NPObject> npobject(NewTrackedNPObject());
+  NPObjectReleaser npobject(NewTrackedNPObject());
   NPObjectToPPVar(instance2.get(), npobject.get());
 
   EXPECT_EQ(1, g_npobjects_alive);
   EXPECT_EQ(1u, tracker().GetLiveObjectsForInstance(pp_instance2));
 
   // Free the instance, this should release the ObjectVar.
   instance2 = NULL;
   EXPECT_EQ(0u, tracker().GetLiveObjectsForInstance(pp_instance2));
 }
 
 // Make sure that using the same NPObject should give the same PP_Var
 // each time.
 TEST_F(ResourceTrackerTest, ReuseVar) {
-  scoped_ptr<NPObject> npobject(NewTrackedNPObject());
+  NPObjectReleaser npobject(NewTrackedNPObject());
 
   PP_Var pp_object1 = NPObjectToPPVar(instance(), npobject.get());
   PP_Var pp_object2 = NPObjectToPPVar(instance(), npobject.get());
 
   // The two results should be the same.
   EXPECT_EQ(pp_object1.value.as_id, pp_object2.value.as_id);
 
   // The objects should be able to get us back to the associated NPObject.
   // This ObjectVar must be released before we do NPObjectToPPVar again
   // below so it gets freed and we get a new identifier.
@@ skipping 11 matching lines @@
 
   // Releasing the resource should free the internal ref, and so making a new
   // one now should generate a new ID.
   PP_Var pp_object3 = NPObjectToPPVar(instance(), npobject.get());
   EXPECT_NE(pp_object1.value.as_id, pp_object3.value.as_id);
   var_tracker->ReleaseVar(static_cast<int32_t>(pp_object3.value.as_id));
 }
 
 }  // namespace ppapi
 }  // namespace webkit