ProfileChooserVIew heap-use-after-free fix

chrome/browser/ui/views/profiles/profile_chooser_view_browsertest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/views/profiles/profile_chooser_view.h"
 
 #include "base/command_line.h"
 #include "base/path_service.h"
 #include "base/prefs/pref_service.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/histogram_tester.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/extensions/extension_browsertest.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/profiles/profile_metrics.h"
 #include "chrome/browser/profiles/profiles_state.h"
+#include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/user_manager.h"
 #include "chrome/browser/ui/views/frame/browser_view.h"
 #include "chrome/browser/ui/views/profiles/avatar_menu_button.h"
 #include "chrome/browser/ui/views/profiles/new_avatar_button.h"
 #include "chrome/browser/ui/views/profiles/user_manager_view.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
 #include "components/signin/core/common/profile_management_switches.h"
@@ skipping 15 matching lines @@
     NOTREACHED() << "Could not create directory at " << path.MaybeAsASCII();
 
   Profile* profile =
       Profile::CreateProfile(path, NULL, Profile::CREATE_MODE_SYNCHRONOUS);
   profile_manager->RegisterTestingProfile(profile, true, false);
   EXPECT_EQ(starting_number_of_profiles + 1,
             profile_manager->GetNumberOfProfiles());
   return profile;
 }
 
+Profile* CreateProfileOutsideUserDataDir() {
+  base::FilePath path;
+  if (!base::CreateNewTempDirectory(base::FilePath::StringType(), &path))
+    NOTREACHED() << "Could not create directory at " << path.MaybeAsASCII();
+
+  ProfileManager* profile_manager = g_browser_process->profile_manager();
+  Profile* profile =
+      Profile::CreateProfile(path, NULL, Profile::CREATE_MODE_SYNCHRONOUS);
+  profile_manager->RegisterTestingProfile(profile, true, false);
+  return profile;
+}
+
+void CloseBrowser(Browser* browser) {
+  content::WindowedNotificationObserver close_observer(
+      chrome::NOTIFICATION_BROWSER_CLOSED,
+      content::Source<Browser>(browser));
+  chrome::CloseWindow(browser);
+  close_observer.Wait();
+}
+
 // Set up the profiles to enable Lock. Takes as parameter a profile that will be
 // signed in, and also creates a supervised user (necessary for lock).
 void SetupProfilesForLock(Profile* signed_in) {
   const char* signed_in_email = "me@google.com";
   Profile* supervised = CreateTestingProfile("supervised");
   ProfileInfoCache* cache = &g_browser_process->profile_manager()->
       GetProfileInfoCache();
   cache->SetAuthInfoOfProfileAtIndex(cache->GetIndexOfProfileWithPath(
     signed_in->GetPath()), "12345", base::UTF8ToUTF16(signed_in_email));
   signed_in->GetPrefs()->
@@ skipping 114 matching lines @@
         current_profile_bubble()->avatar_menu_.get());
     base::MessageLoop::current()->RunUntilIdle();
   }
 
  private:
   scoped_ptr<content::WindowedNotificationObserver> window_close_observer_;
 
   DISALLOW_COPY_AND_ASSIGN(ProfileChooserViewExtensionsTest);
 };
 
+IN_PROC_BROWSER_TEST_F(ProfileChooserViewExtensionsTest,
+    ProfileChooserOnMultipleBrowsers) {
+  // Test that the profile chooser view should be deleted when the browser is
+  // deleted. Even if the profile is not in user_data_dir.

[msw, 2015/09/10 23:42:00]

Why does the profile's location matter for this test?

+  Profile* new_profile = CreateProfileOutsideUserDataDir();
+  Browser* browser = CreateBrowser(new_profile);
+  browser->window()->ShowAvatarBubbleFromAvatarButton(
+      BrowserWindow::AVATAR_BUBBLE_MODE_CONFIRM_SIGNIN,
+      signin::ManageAccountsParams());
+  EXPECT_TRUE(ProfileChooserView::IsShowing());
+  CloseBrowser(browser);
+  ASSERT_FALSE(ProfileChooserView::IsShowing()) << "Bubble was not deleted";
+}
+
 IN_PROC_BROWSER_TEST_F(ProfileChooserViewExtensionsTest, SigninButtonHasFocus) {
   ASSERT_TRUE(profiles::IsMultipleProfilesEnabled());
   ASSERT_NO_FATAL_FAILURE(OpenProfileChooserView(browser()));
 
   EXPECT_TRUE(signin_current_profile_link()->HasFocus());
 }
 
 IN_PROC_BROWSER_TEST_F(ProfileChooserViewExtensionsTest, ContentAreaHasFocus) {
   ASSERT_TRUE(profiles::IsMultipleProfilesEnabled());
 
@@ skipping 91 matching lines @@
   EXPECT_EQ(1U, BrowserList::GetInstance(chrome::GetActiveDesktop())->size());
 
   WaitForUserManager();
   // Assert that the first profile's extensions are not blocked.
   ASSERT_EQ(total_enabled_extensions, registry->enabled_extensions().size());
   ASSERT_EQ(0U, registry->blocked_extensions().size());
 
   // We need to hide the User Manager or else the process can't die.
   UserManager::Hide();
 }