Call reset(nullptr) in scoped_ptr's.

base/memory/scoped_ptr_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/memory/scoped_ptr.h"
 
 #include <sstream>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
@@ skipping 697 matching lines @@
   StructA* a = new StructA;
   a->b.reset(new StructB);
   a->b->a.reset(a);
 
   // Break the cycle by calling reset(). This will cause |a| (and hence, |a.b|)
   // to be deleted before the call to reset() returns. This tests that the
   // implementation of scoped_ptr::reset() doesn't access |this| after it
   // deletes the underlying pointer. This behaviour is consistent with the
   // definition of unique_ptr::reset in C++11.
   a->b.reset();
+
+  // Go again, but this time, break the cycle by invoking |a|'s destructor. This
+  // tests that the implementation of ~scoped_ptr doesn't infinitely recurse
+  // into the destructors of |a| and |a.b|. Note, deleting |a| instead will

[Peter Kasting, 2015/09/23 20:35:49]

Nit: a.b -> a->b

[Anand Mistry (off Chromium), 2015/09/23 23:06:34]

Done.

+  // cause |a| to be double-free'd because |a.b| owns |a| and deletes it via its
+  // destructor.

[Peter Kasting, 2015/09/23 20:35:49]

Nit: Maybe change this last sentence to the following, assuming it's
accurate/you agree:

Note that unless code actually calls a destructor directly like this, the only
way to trigger this call chain normally would be to delete one of the pointers,
which would cause a double-free.  Still, a double-free (and then hopefully
crash) is better than having the program hang.

[danakj, 2015/09/23 20:38:10]

I think I prefer the original for a unit test comment.

[Anand Mistry (off Chromium), 2015/09/23 23:06:34]

danakj: Do you mean what I wrote, or what pkasting suggest?

+  a = new StructA;
+  a->b.reset(new StructB);
+  a->b->a.reset(a);
+  a->~StructA();
 }