Call -browserWillBeDestroyed before releasing ToolbarController in unit tests.

chrome/browser/ui/cocoa/toolbar/toolbar_controller_unittest.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import <Cocoa/Cocoa.h>
 
 #import "base/mac/scoped_nsobject.h"
 #include "base/prefs/pref_service.h"
 #include "base/run_loop.h"
 #include "chrome/app/chrome_command_ids.h"
@@ skipping 80 matching lines @@
         initWithCommands:browser()->command_controller()->command_updater()
                  profile:profile()
                  browser:browser()
           resizeDelegate:resizeDelegate_.get()]);
     EXPECT_TRUE([bar_ view]);
     NSView* parent = [test_window() contentView];
     [parent addSubview:[bar_ view]];
   }
 
   void TearDown() override {
-    bar_.reset();  // browser() must outlive the ToolbarController.
+    // Releasing ToolbarController doesn't actually free it at this point, since
+    // the NSViewController retains a reference to it from the nib loading.
+    // As browser() is released in the superclass TearDown, call
+    // -[ToolbarController browserWillBeDestroyed] to prevent a use after free
+    // issue on the |browser_| pointer in LocationBarViewMac when
+    // ToolbarController is actually freed (some time after this method is run).
+    [bar_ browserWillBeDestroyed];
+    bar_.reset();
     CocoaProfileTest::TearDown();
   }
 
   // Make sure the enabled state of the view is the same as the corresponding
   // command in the updater. The views are in the declaration order of outlets.
   void CompareState(CommandUpdater* updater, NSArray* views) {
     EXPECT_EQ(updater->IsCommandEnabled(IDC_BACK),
               [[views objectAtIndex:kBackIndex] isEnabled] ? true : false);
     EXPECT_EQ(updater->IsCommandEnabled(IDC_FORWARD),
               [[views objectAtIndex:kForwardIndex] isEnabled] ? true : false);
@@ skipping 227 matching lines @@
 TEST_F(ToolbarControllerTest, TranslateBubblePoint) {
   const NSPoint translatePoint = [bar_ translateBubblePoint];
   const NSRect barFrame =
       [[bar_ view] convertRect:[[bar_ view] bounds] toView:nil];
   EXPECT_TRUE(NSPointInRect(translatePoint, barFrame));
 }
 
 TEST_F(ToolbarControllerTest, HoverButtonForEvent) {
   base::scoped_nsobject<HitView> view(
       [[HitView alloc] initWithFrame:NSMakeRect(0, 0, 100, 100)]);
+  NSView* toolbarView = [bar_ view];
   [bar_ setView:view];
   NSEvent* event = [NSEvent mouseEventWithType:NSMouseMoved
                                       location:NSMakePoint(10,10)
                                  modifierFlags:0
                                      timestamp:0
                                   windowNumber:0
                                        context:nil
                                    eventNumber:0
                                     clickCount:0
                                       pressure:0.0];
 
   // NOT a match.
   [view setHitTestReturn:bar_.get()];
   EXPECT_FALSE([bar_ hoverButtonForEvent:event]);
 
   // Not yet...
   base::scoped_nsobject<NSButton> button([[NSButton alloc] init]);
   [view setHitTestReturn:button];
   EXPECT_FALSE([bar_ hoverButtonForEvent:event]);
 
   // Now!
   base::scoped_nsobject<ImageButtonCell> cell(
       [[ImageButtonCell alloc] init]);
   [button setCell:cell.get()];
   EXPECT_TRUE([bar_ hoverButtonForEvent:nil]);
+
+  // Restore the original view so that
+  // -[ToolbarController browserWillBeDestroyed] will run correctly.
+  [bar_ setView:toolbarView];
 }
 
 class BrowserRemovedObserver : public chrome::BrowserListObserver {
  public:
   BrowserRemovedObserver() { BrowserList::AddObserver(this); }
   ~BrowserRemovedObserver() override { BrowserList::RemoveObserver(this); }
   void WaitUntilBrowserRemoved() { run_loop_.Run(); }
   void OnBrowserRemoved(Browser* browser) override { run_loop_.Quit(); }
 
  private:
   base::RunLoop run_loop_;
 
   DISALLOW_COPY_AND_ASSIGN(BrowserRemovedObserver);
 };
 
-// Test that ToolbarController can be destroyed after the Browser.
-// This can happen because the ToolbarController is retained by both the
-// BrowserWindowController and -[ToolbarController view], the latter of which is
-// autoreleased.
-TEST_F(ToolbarControllerTest, ToolbarDestroyedAfterBrowser) {
-  BrowserRemovedObserver observer;
-  // This is normally called by BrowserWindowController, but since |bar_| is not
-  // owned by one, call it here.
-  [bar_ browserWillBeDestroyed];
-  CloseBrowserWindow();
-  observer.WaitUntilBrowserRemoved();
-  // |bar_| is released in TearDown().
-}
-
 }  // namespace