Fix use after free in memory only backend.

net/disk_cache/backend_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 
 #include "base/files/file_util.h"
 #include "base/metrics/field_trial.h"
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 2929 matching lines @@
 }
 
 TEST_F(DiskCacheBackendTest, MemoryOnlyBackendEviction) {
   SetMemoryOnlyMode();
   BackendEviction();
 }
 
 // TODO(gavinp): Enable BackendEviction test for simple cache after performance
 // problems are addressed. See crbug.com/588184 for more information.
 
+// This overly specific looking test is a regression test aimed at
+// crbug.com/589186.
+TEST_F(DiskCacheBackendTest, MemoryCacheUseAfterFree) {

[mmenke, 2016/02/25 07:14:05]

Should we run similar tests for disk cache implementations?  Looks to me like
even the block file cache doesn't have this issue, but still seems like
something worth testing.  Fine to worry about it in another CL.

[gavinp, 2016/02/25 15:55:32]

Acknowledged.

+  SetMemoryOnlyMode();
+
+  const int kMaxSize = 200 * 1024;
+  const int kMaxEntryCount = 20;
+  const int kWriteSize = kMaxSize / kMaxEntryCount;
+
+  SetMaxSize(kMaxSize);
+  InitCache();
+
+  scoped_refptr<net::IOBuffer> buffer(new net::IOBuffer(kWriteSize));
+  CacheTestFillBuffer(buffer->data(), kWriteSize, false);
+
+  // Create an entry to be our sparse entry that gets written later.
+  disk_cache::Entry* entry;
+  ASSERT_EQ(net::OK, CreateEntry("first parent", &entry));
+  disk_cache::ScopedEntryPtr first_parent(entry);
+  EXPECT_EQ(1024, first_parent->WriteSparseData(0, buffer.get(), 1024,

[mmenke, 2016/02/25 07:14:06]

Should have a comment about why this first write is needed.

[gavinp, 2016/02/25 15:55:32]

Actually, it's not needed, so it's removed.

+                                                net::CompletionCallback()));
+
+  // Create a ton of entries, and keep them open, to put the cache well above
+  // its eviction threshhold.
+  const int kTooManyEntriesCount = kMaxEntryCount * 2;
+  disk_cache::ScopedEntryPtr open_entries[kTooManyEntriesCount];

[mmenke, 2016/02/25 07:14:06]

optional:  I'd suggest just using a std::vector<disk_cache::ScopedEntryPtr> or
std::list, just to make the test more flexible for future changes.

[gavinp, 2016/02/25 15:55:32]

Done.

+  std::string key_prefix("prefix");
+  for (int i = 0; i < kTooManyEntriesCount; ++i) {
+    ASSERT_EQ(net::OK, CreateEntry(key_prefix + base::IntToString(i), &entry));
+    EXPECT_EQ(kWriteSize,
+              WriteData(entry, 1, 0, buffer.get(), kWriteSize, false));
+    open_entries[i].reset(entry);
+  }
+  EXPECT_LT(kMaxSize, CalculateSizeOfAllEntries());
+
+  // Writing this sparse data should not crash.
+  EXPECT_EQ(1024, first_parent->WriteSparseData(32768, buffer.get(), 1024,
+                                                net::CompletionCallback()));
+}
+
 TEST_F(DiskCacheTest, Backend_UsageStatsTimer) {
   MessageLoopHelper helper;
 
   ASSERT_TRUE(CleanupCacheDir());
   scoped_ptr<disk_cache::BackendImpl> cache;
   cache.reset(new disk_cache::BackendImpl(
       cache_path_, base::ThreadTaskRunnerHandle::Get(), NULL));
   ASSERT_TRUE(NULL != cache.get());
   cache->SetUnitTestMode();
   ASSERT_EQ(net::OK, cache->SyncInit());
@@ skipping 743 matching lines @@
 // after closing.
 // NOTE: IF THIS TEST IS FLAKY THEN IT IS FAILING. See https://crbug.com/416940
 TEST_F(DiskCacheBackendTest, SimpleCacheDeleteQuickly) {
   SetSimpleCacheMode();
   for (int i = 0; i < 100; ++i) {
     InitCache();
     cache_.reset();
     EXPECT_TRUE(CleanupCacheDir());
   }
 }