Fix use after free in memory only backend.

net/disk_cache/backend_unittest.cc

Index: net/disk_cache/backend_unittest.cc
diff --git a/net/disk_cache/backend_unittest.cc b/net/disk_cache/backend_unittest.cc
index ebd2f578ae578a2df3d50d7b20f2642d0d26aa4d..394c43fb9f60423844a16acb0be1f295f3b9e15f 100644
--- a/net/disk_cache/backend_unittest.cc
+++ b/net/disk_cache/backend_unittest.cc
@@ -2947,6 +2947,46 @@ TEST_F(DiskCacheBackendTest, MemoryOnlyBackendEviction) {
 // TODO(gavinp): Enable BackendEviction test for simple cache after performance
 // problems are addressed. See crbug.com/588184 for more information.
 
+// This overly specific looking test is a regression test aimed at
+// crbug.com/589186.
+TEST_F(DiskCacheBackendTest, MemoryCacheUseAfterFree) {

[mmenke, 2016/02/25 07:14:05]

Should we run similar tests for disk cache implementations?  Looks to me like
even the block file cache doesn't have this issue, but still seems like
something worth testing.  Fine to worry about it in another CL.

[gavinp, 2016/02/25 15:55:32]

Acknowledged.

+  SetMemoryOnlyMode();
+
+  const int kMaxSize = 200 * 1024;
+  const int kMaxEntryCount = 20;
+  const int kWriteSize = kMaxSize / kMaxEntryCount;
+
+  SetMaxSize(kMaxSize);
+  InitCache();
+
+  scoped_refptr<net::IOBuffer> buffer(new net::IOBuffer(kWriteSize));
+  CacheTestFillBuffer(buffer->data(), kWriteSize, false);
+
+  // Create an entry to be our sparse entry that gets written later.
+  disk_cache::Entry* entry;
+  ASSERT_EQ(net::OK, CreateEntry("first parent", &entry));
+  disk_cache::ScopedEntryPtr first_parent(entry);
+  EXPECT_EQ(1024, first_parent->WriteSparseData(0, buffer.get(), 1024,

[mmenke, 2016/02/25 07:14:06]

Should have a comment about why this first write is needed.

[gavinp, 2016/02/25 15:55:32]

Actually, it's not needed, so it's removed.

+                                                net::CompletionCallback()));
+
+  // Create a ton of entries, and keep them open, to put the cache well above
+  // its eviction threshhold.
+  const int kTooManyEntriesCount = kMaxEntryCount * 2;
+  disk_cache::ScopedEntryPtr open_entries[kTooManyEntriesCount];

[mmenke, 2016/02/25 07:14:06]

optional:  I'd suggest just using a std::vector<disk_cache::ScopedEntryPtr> or
std::list, just to make the test more flexible for future changes.

[gavinp, 2016/02/25 15:55:32]

Done.

+  std::string key_prefix("prefix");
+  for (int i = 0; i < kTooManyEntriesCount; ++i) {
+    ASSERT_EQ(net::OK, CreateEntry(key_prefix + base::IntToString(i), &entry));
+    EXPECT_EQ(kWriteSize,
+              WriteData(entry, 1, 0, buffer.get(), kWriteSize, false));
+    open_entries[i].reset(entry);
+  }
+  EXPECT_LT(kMaxSize, CalculateSizeOfAllEntries());
+
+  // Writing this sparse data should not crash.
+  EXPECT_EQ(1024, first_parent->WriteSparseData(32768, buffer.get(), 1024,
+                                                net::CompletionCallback()));
+}
+
 TEST_F(DiskCacheTest, Backend_UsageStatsTimer) {
   MessageLoopHelper helper;