ProfileChooserVIew heap-use-after-free fix

chrome/browser/ui/views/profiles/profile_chooser_view_browsertest.cc

Index: chrome/browser/ui/views/profiles/profile_chooser_view_browsertest.cc
diff --git a/chrome/browser/ui/views/profiles/profile_chooser_view_browsertest.cc b/chrome/browser/ui/views/profiles/profile_chooser_view_browsertest.cc
index 00c34db86403cf1327df2c1fd5389adb8018eb15..1d9f430c49b890a3aa3aeec9fd7d3d22d8d690d2 100644
--- a/chrome/browser/ui/views/profiles/profile_chooser_view_browsertest.cc
+++ b/chrome/browser/ui/views/profiles/profile_chooser_view_browsertest.cc
@@ -15,6 +15,7 @@
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/profiles/profile_metrics.h"
 #include "chrome/browser/profiles/profiles_state.h"
+#include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/user_manager.h"
 #include "chrome/browser/ui/views/frame/browser_view.h"
@@ -50,6 +51,26 @@ Profile* CreateTestingProfile(const std::string& profile_name) {
   return profile;
 }
 
+Profile* CreateProfileOutsideUserDataDir() {
+  base::FilePath path;
+  if (!base::CreateNewTempDirectory(base::FilePath::StringType(), &path))
+    NOTREACHED() << "Could not create directory at " << path.MaybeAsASCII();
+
+  ProfileManager* profile_manager = g_browser_process->profile_manager();
+  Profile* profile =

[msw, 2015/09/15 19:44:36]

Should this be a TestingProfile instance?

[shadi1, 2015/09/15 20:47:43]

Not sure what you mean by that? 

TestingProfileManager::CreateTestingProfile() does not have an option to  
create a profile with path outside user data dir. Since this is a special case
test, I think having this function here is fair.

[msw, 2015/09/15 21:40:45]

If it's a profile used for testing, perhaps it should be a TestingProfile
instance. Check out its 3 ctors that takes more args (ie. a |path| arg):
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/test/base/t...

+      Profile::CreateProfile(path, NULL, Profile::CREATE_MODE_SYNCHRONOUS);
+  profile_manager->RegisterTestingProfile(profile, true, false);
+  return profile;
+}
+
+void CloseBrowser(Browser* browser) {

[msw, 2015/09/15 19:44:36]

As an ExtensionBrowserTest, which is an InProcessBrowserTest, call
InProcessBrowserTest::CloseBrowserSynchronously in the test fixture, instead of
duplicating its code here.

[shadi1, 2015/09/15 20:47:43]

Cool, thanks for pointing that function out.

+  content::WindowedNotificationObserver close_observer(
+      chrome::NOTIFICATION_BROWSER_CLOSED,
+      content::Source<Browser>(browser));
+  chrome::CloseWindow(browser);
+  close_observer.Wait();
+}
+
 // Set up the profiles to enable Lock. Takes as parameter a profile that will be
 // signed in, and also creates a supervised user (necessary for lock).
 void SetupProfilesForLock(Profile* signed_in) {
@@ -184,6 +205,20 @@ class ProfileChooserViewExtensionsTest : public ExtensionBrowserTest {
   DISALLOW_COPY_AND_ASSIGN(ProfileChooserViewExtensionsTest);
 };
 
+IN_PROC_BROWSER_TEST_F(ProfileChooserViewExtensionsTest,
+    NoProfileChooserOnOutsideUserDataDirProfiles) {
+  // Test that the profile chooser view does not show when avatar menu is not
+  // available. This can be repro'ed with a profile path outside user_data_dir.
+  // crbug.com/527505
+  Profile* new_profile = CreateProfileOutsideUserDataDir();
+  Browser* browser = CreateBrowser(new_profile);
+  browser->window()->ShowAvatarBubbleFromAvatarButton(
+      BrowserWindow::AVATAR_BUBBLE_MODE_CONFIRM_SIGNIN,
+      signin::ManageAccountsParams());
+  ASSERT_FALSE(ProfileChooserView::IsShowing());
+  CloseBrowser(browser);
+}
+
 IN_PROC_BROWSER_TEST_F(ProfileChooserViewExtensionsTest, SigninButtonHasFocus) {
   ASSERT_TRUE(profiles::IsMultipleProfilesEnabled());
   ASSERT_NO_FATAL_FAILURE(OpenProfileChooserView(browser()));