Add some instrumentation to investigate a possible UAF.

net/base/net_log.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/net_log.h"
 
 #include "base/bind.h"
+#ifdef TEMP_INSTRUMENTATION_467797
+#include "base/debug/alias.h"
+#endif
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
 #include "base/values.h"
 #include "net/base/net_errors.h"
 
 namespace net {
 
 namespace {
@@ skipping 373 matching lines @@
   if (GetLogLevel() == LOG_NONE)
     return;
   EntryData entry_data(type, source, phase, base::TimeTicks::Now(),
                        parameters_callback);
 
   // Notify all of the log observers.
   base::AutoLock lock(lock_);
   FOR_EACH_OBSERVER(ThreadSafeObserver, observers_, OnAddEntryData(entry_data));
 }
 
+BoundNetLog::~BoundNetLog() {
+#ifdef TEMP_INSTRUMENTATION_467797
+  liveness_ = DEAD;
+  stack_trace_ = base::debug::StackTrace();
+
+  // Probably not necessary, but just in case compiler tries to optimize out the
+  // writes to liveness_ and stack_trace_.
+  base::debug::Alias(&liveness_);
+  base::debug::Alias(&stack_trace_);
+#endif
+}
+
 void BoundNetLog::AddEntry(NetLog::EventType type,
                            NetLog::EventPhase phase) const {
+  CrashIfInvalid();
+
   if (!net_log_)
     return;
   net_log_->AddEntry(type, source_, phase, NULL);
 }
 
 void BoundNetLog::AddEntry(
     NetLog::EventType type,
     NetLog::EventPhase phase,
     const NetLog::ParametersCallback& get_parameters) const {
+  CrashIfInvalid();
+
   if (!net_log_)
     return;
   net_log_->AddEntry(type, source_, phase, &get_parameters);
 }
 
 void BoundNetLog::AddEvent(NetLog::EventType type) const {
   AddEntry(type, NetLog::PHASE_NONE);
 }
 
 void BoundNetLog::AddEvent(
@@ skipping 42 matching lines @@
   }
 }
 
 void BoundNetLog::AddByteTransferEvent(NetLog::EventType event_type,
                                        int byte_count,
                                        const char* bytes) const {
   AddEvent(event_type, base::Bind(BytesTransferredCallback, byte_count, bytes));
 }
 
 NetLog::LogLevel BoundNetLog::GetLogLevel() const {
+  CrashIfInvalid();
+
   if (net_log_)
     return net_log_->GetLogLevel();
   return NetLog::LOG_NONE;
 }
 
 bool BoundNetLog::IsLoggingBytes() const {
   return NetLog::IsLoggingBytes(GetLogLevel());
 }
 
 bool BoundNetLog::IsLogging() const {
   return NetLog::IsLogging(GetLogLevel());
 }
 
 // static
 BoundNetLog BoundNetLog::Make(NetLog* net_log,
                               NetLog::SourceType source_type) {
   if (!net_log)
     return BoundNetLog();
 
   NetLog::Source source(source_type, net_log->NextID());
   return BoundNetLog(source, net_log);
 }
 
+void BoundNetLog::CrashIfInvalid() const {
+#ifdef TEMP_INSTRUMENTATION_467797
+  Liveness liveness = liveness_;
+
+  if (liveness == ALIVE)
+    return;
+
+  // Copy relevant variables onto the stack to guarantee they will be available
+  // in minidumps, and then crash.
+  base::debug::StackTrace stack_trace = stack_trace_;
+
+  base::debug::Alias(&liveness);
+  base::debug::Alias(&stack_trace);
+
+  CHECK_EQ(ALIVE, liveness);
+#endif
+}
+
 }  // namespace net