net: Add fuzzer for HostResolverImpl.

net/dns/host_resolver_impl.h

Index: net/dns/host_resolver_impl.h
diff --git a/net/dns/host_resolver_impl.h b/net/dns/host_resolver_impl.h
index 5c3124cba5962bce899455a799e9e77e65a10bd4..b3126633fdc8eda660742a2be7a1b088197a0e99 100644
--- a/net/dns/host_resolver_impl.h
+++ b/net/dns/host_resolver_impl.h
@@ -32,10 +32,10 @@ class NetLog;
 
 // For each hostname that is requested, HostResolver creates a
 // HostResolverImpl::Job. When this job gets dispatched it creates a ProcTask
-// which runs the given HostResolverProc on a WorkerPool thread. If requests for
-// that same host are made during the job's lifetime, they are attached to the
-// existing job rather than creating a new one. This avoids doing parallel
-// resolves for the same host.
+// which runs the given HostResolverProc on a worker thread (a WorkerPool
+// thread, in production code.) If requests for that same host are made during
+// the job's lifetime, they are attached to the existing job rather than
+// creating a new one. This avoids doing parallel resolves for the same host.
 //
 // The way these classes fit together is illustrated by:
 //
@@ -68,7 +68,7 @@ class NET_EXPORT HostResolverImpl
   // Parameters for ProcTask which resolves hostnames using HostResolveProc.
   //
   // |resolver_proc| is used to perform the actual resolves; it must be
-  // thread-safe since it is run from multiple worker threads. If
+  // thread-safe since it may be run from multiple worker threads. If
   // |resolver_proc| is NULL then the default host resolver procedure is
   // used (which is SystemHostResolverProc except if overridden).
   //
@@ -103,7 +103,8 @@ class NET_EXPORT HostResolverImpl
     uint32_t retry_factor;
   };
 
-  // Creates a HostResolver as specified by |options|.
+  // Creates a HostResolver as specified by |options|. Blocking tasks are run on
+  // the WorkerPool.
   //
   // If Options.enable_caching is true, a cache is created using
   // HostCache::CreateDefaultCache(). Otherwise no cache is used.
@@ -151,6 +152,16 @@ class NET_EXPORT HostResolverImpl
     proc_params_ = proc_params;
   }
 
+ protected:
+  // Just like the public constructor, but allows the task runner used for
+  // blocking tasks to be specified. Intended for testing only.
+  HostResolverImpl(const Options& options,
+                   NetLog* net_log,
+                   scoped_refptr<base::TaskRunner> worker_task_runner);
+
+  // Callback from HaveOnlyLoopbackAddresses probe.
+  void SetHaveOnlyLoopbackAddresses(bool result);
+
  private:
   friend class HostResolverImplTest;
   class Job;
@@ -204,9 +215,6 @@ class NET_EXPORT HostResolverImpl
                       const RequestInfo& info,
                       AddressList* addresses);
 
-  // Callback from HaveOnlyLoopbackAddresses probe.
-  void SetHaveOnlyLoopbackAddresses(bool result);
-
   // Returns the (hostname, address_family) key to use for |info|, choosing an
   // "effective" address family by inheriting the resolver's default address
   // family when the request leaves it unspecified.
@@ -219,6 +227,9 @@ class NET_EXPORT HostResolverImpl
   // from the first probe for some time before probing again.
   virtual bool IsIPv6Reachable(const BoundNetLog& net_log);
 
+  // Asynchronously checks if only loopback IPs are available.
+  virtual void RunLoopbackProbeJob();
+
   // Records the result in cache if cache is present.
   void CacheResult(const Key& key,
                    const HostCache::Entry& entry,
@@ -311,6 +322,11 @@ class NET_EXPORT HostResolverImpl
   // Allow fallback to ProcTask if DnsTask fails.
   bool fallback_to_proctask_;
 
+  // Task runner used for DNS lookups using the platform resolver, and other
+  // blocking operations. Usually just the WorkerPool's task runner for slow
+  // tasks, but can be overridden for tests.
+  scoped_refptr<base::TaskRunner> worker_task_runner_;
+
   base::WeakPtrFactory<HostResolverImpl> weak_ptr_factory_;
 
   base::WeakPtrFactory<HostResolverImpl> probe_weak_ptr_factory_;