Fix use-after-free issue in VideoDecoderResourceTest.

ppapi/proxy/video_decoder_resource_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <GLES2/gl2.h>
 #include <stddef.h>
 #include <stdint.h>
 
 #include "base/memory/shared_memory.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 129 matching lines @@
   int32_t CallDecode(PP_Resource pp_decoder,
                      MockCompletionCallback* cb,
                      const PpapiHostMsg_VideoDecoder_GetShm* expected_shm_msg) {
     // Set up a handler in case the resource sends a sync message to create
     // shared memory.
     PpapiPluginMsg_VideoDecoder_GetShmReply shm_msg_reply(kShmSize);
     ResourceSyncCallHandler shm_msg_handler(
         &sink(), PpapiHostMsg_VideoDecoder_GetShm::ID, PP_OK, shm_msg_reply);
     sink().AddFilter(&shm_msg_handler);
 
+    std::unique_ptr<base::SharedMemoryHandle> shm_handle;
+    std::unique_ptr<SerializedHandle> serialized_handle;
     base::SharedMemory shm;
     if (expected_shm_msg) {
       shm.CreateAnonymous(kShmSize);
-      base::SharedMemoryHandle shm_handle;
-      shm.ShareToProcess(base::GetCurrentProcessHandle(), &shm_handle);
-      SerializedHandle serialized_handle(shm_handle, kShmSize);
-      shm_msg_handler.set_serialized_handle(&serialized_handle);
+      shm_handle.reset(new base::SharedMemoryHandle());
+      shm.ShareToProcess(base::GetCurrentProcessHandle(), shm_handle.get());
+      serialized_handle.reset(new SerializedHandle(*shm_handle, kShmSize));
+      shm_msg_handler.set_serialized_handle(serialized_handle.get());
     }
 
     memset(decode_buffer_, 0x55, kDecodeBufferSize);
     int32_t result =
         decoder_iface()->Decode(pp_decoder,
                                 kDecodeId,
                                 kDecodeBufferSize,
                                 decode_buffer_,
                                 PP_MakeOptionalCompletionCallback(
                                     &MockCompletionCallback::Callback, cb));
@@ skipping 415 matching lines @@
   ASSERT_FALSE(uncalled_cb.called());
   ASSERT_EQ(PP_ERROR_RESOURCE_FAILED, CallFlush(decoder.get(), &uncalled_cb));
   ASSERT_FALSE(uncalled_cb.called());
   ASSERT_EQ(PP_ERROR_RESOURCE_FAILED, CallReset(decoder.get(), &uncalled_cb));
   ASSERT_FALSE(uncalled_cb.called());
 }
 #endif  // !defined(OS_WIN) || !defined(ARCH_CPU_64_BITS)
 
 }  // namespace proxy
 }  // namespace ppapi