Allow CertNetFetcher to be shutdown from the network thread

net/cert/internal/cert_issuer_source_aia_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/cert_issuer_source_aia.h"
 
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "net/cert/cert_net_fetcher.h"
 #include "net/cert/internal/cert_errors.h"
@@ skipping 45 matching lines @@
 std::vector<uint8_t> CertDataVector(const ParsedCertificate* cert) {
   std::vector<uint8_t> data(
       cert->der_cert().UnsafeData(),
       cert->der_cert().UnsafeData() + cert->der_cert().Length());
   return data;
 }
 
 // MockCertNetFetcher is an implementation of CertNetFetcher for testing.
 class MockCertNetFetcher : public CertNetFetcher {
  public:
+  MockCertNetFetcher() {}
+  MOCK_METHOD0(Shutdown, void());
   MOCK_METHOD3(FetchCaIssuers,
                std::unique_ptr<Request>(const GURL& url,
                                         int timeout_milliseconds,
                                         int max_response_bytes));
   MOCK_METHOD3(FetchCrl,
                std::unique_ptr<Request>(const GURL& url,
                                         int timeout_milliseconds,
                                         int max_response_bytes));
 
   MOCK_METHOD3(FetchOcsp,
                std::unique_ptr<Request>(const GURL& url,
                                         int timeout_milliseconds,
                                         int max_response_bytes));
+
+ protected:
+  ~MockCertNetFetcher() override {}
 };
 
 // MockCertNetFetcherRequest gives back the indicated error and bytes.
 class MockCertNetFetcherRequest : public CertNetFetcher::Request {
  public:
   MockCertNetFetcherRequest(Error error, std::vector<uint8_t> bytes)
       : error_(error), bytes_(std::move(bytes)) {}
 
   void WaitForResult(Error* error, std::vector<uint8_t>* bytes) override {
     DCHECK(!did_consume_result_);
@@ skipping 20 matching lines @@
     const std::vector<uint8_t>& bytes) {
   return base::MakeUnique<MockCertNetFetcherRequest>(OK, bytes);
 }
 
 // CertIssuerSourceAia does not return results for SyncGetIssuersOf.
 TEST(CertIssuerSourceAiaTest, NoSyncResults) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_two_aia.pem", &cert));
 
   // No methods on |mock_fetcher| should be called.
-  StrictMock<MockCertNetFetcher> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcher>> mock_fetcher(

[eroman, 2017/01/11 01:56:59]

nit: make_scoped_refptr() ?

[estark, 2017/01/12 01:06:30]

Done.

+      new StrictMock<MockCertNetFetcher>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   ParsedCertificateList issuers;
   aia_source.SyncGetIssuersOf(cert.get(), &issuers);
   EXPECT_EQ(0U, issuers.size());
 }
 
 // If the AuthorityInfoAccess extension is not present, AsyncGetIssuersOf should
 // synchronously indicate no results.
 TEST(CertIssuerSourceAiaTest, NoAia) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_no_aia.pem", &cert));
 
   // No methods on |mock_fetcher| should be called.
-  StrictMock<MockCertNetFetcher> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcher>> mock_fetcher(
+      new StrictMock<MockCertNetFetcher>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> request;
   aia_source.AsyncGetIssuersOf(cert.get(), &request);
   EXPECT_EQ(nullptr, request);
 }
 
 // If the AuthorityInfoAccess extension only contains non-HTTP URIs,
 // AsyncGetIssuersOf should create a Request object. The URL scheme check is
 // part of the specific CertNetFetcher implementation, this tests that we handle
 // ERR_DISALLOWED_URL_SCHEME properly. If FetchCaIssuers is modified to fail
 // synchronously in that case, this test will be more interesting.
 TEST(CertIssuerSourceAiaTest, FileAia) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_file_aia.pem", &cert));
 
-  StrictMock<MockCertNetFetcher> mock_fetcher;
-  EXPECT_CALL(mock_fetcher, FetchCaIssuers(GURL("file:///dev/null"), _, _))
+  scoped_refptr<StrictMock<MockCertNetFetcher>> mock_fetcher(
+      new StrictMock<MockCertNetFetcher>());
+  EXPECT_CALL(*mock_fetcher.get(),

[eroman, 2017/01/11 01:56:59]

nit: I don't believe the .get() is needed here -- scoped_refptr<> has an
overloaded operator*().

[estark, 2017/01/12 01:06:30]

Done.

+              FetchCaIssuers(GURL("file:///dev/null"), _, _))
       .WillOnce(Return(ByMove(CreateMockRequest(ERR_DISALLOWED_URL_SCHEME))));
 
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(), &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   // No results.
   ParsedCertificateList result_certs;
   cert_source_request->GetNext(&result_certs);
   EXPECT_TRUE(result_certs.empty());
 }
 
 // If the AuthorityInfoAccess extension contains an invalid URL,
 // AsyncGetIssuersOf should synchronously indicate no results.
 TEST(CertIssuerSourceAiaTest, OneInvalidURL) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_invalid_url_aia.pem", &cert));
 
-  StrictMock<MockCertNetFetcher> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcher>> mock_fetcher(
+      new StrictMock<MockCertNetFetcher>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> request;
   aia_source.AsyncGetIssuersOf(cert.get(), &request);
   EXPECT_EQ(nullptr, request);
 }
 
 // AuthorityInfoAccess with a single HTTP url pointing to a single DER cert.
 TEST(CertIssuerSourceAiaTest, OneAia) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_one_aia.pem", &cert));
   scoped_refptr<ParsedCertificate> intermediate_cert;
   ASSERT_TRUE(ReadTestCert("i.pem", &intermediate_cert));
 
-  StrictMock<MockCertNetFetcher> mock_fetcher;
+  scoped_refptr<StrictMock<MockCertNetFetcher>> mock_fetcher(
+      new StrictMock<MockCertNetFetcher>());
 
-  EXPECT_CALL(mock_fetcher,
+  EXPECT_CALL(*mock_fetcher.get(),
               FetchCaIssuers(GURL("http://url-for-aia/I.cer"), _, _))
       .WillOnce(Return(
           ByMove(CreateMockRequest(CertDataVector(intermediate_cert.get())))));
 
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(), &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   ParsedCertificateList result_certs;
   cert_source_request->GetNext(&result_certs);
   ASSERT_EQ(1u, result_certs.size());
   ASSERT_EQ(result_certs.front()->der_cert(), intermediate_cert->der_cert());
 
   result_certs.clear();
   cert_source_request->GetNext(&result_certs);
   EXPECT_TRUE(result_certs.empty());
 }
 
 // AuthorityInfoAccess with two URIs, one a FILE, the other a HTTP.
 // Simulate a ERR_DISALLOWED_URL_SCHEME for the file URL. If FetchCaIssuers is
 // modified to synchronously reject disallowed schemes, this test will be more
 // interesting.
 TEST(CertIssuerSourceAiaTest, OneFileOneHttpAia) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_file_and_http_aia.pem", &cert));
   scoped_refptr<ParsedCertificate> intermediate_cert;
   ASSERT_TRUE(ReadTestCert("i2.pem", &intermediate_cert));
 
-  StrictMock<MockCertNetFetcher> mock_fetcher;
+  scoped_refptr<StrictMock<MockCertNetFetcher>> mock_fetcher(
+      new StrictMock<MockCertNetFetcher>());
 
-  EXPECT_CALL(mock_fetcher, FetchCaIssuers(GURL("file:///dev/null"), _, _))
+  EXPECT_CALL(*mock_fetcher.get(),
+              FetchCaIssuers(GURL("file:///dev/null"), _, _))
       .WillOnce(Return(ByMove(CreateMockRequest(ERR_DISALLOWED_URL_SCHEME))));
 
-  EXPECT_CALL(mock_fetcher,
+  EXPECT_CALL(*mock_fetcher.get(),
               FetchCaIssuers(GURL("http://url-for-aia2/I2.foo"), _, _))
       .WillOnce(Return(
           ByMove(CreateMockRequest(CertDataVector(intermediate_cert.get())))));
 
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(), &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   ParsedCertificateList result_certs;
   cert_source_request->GetNext(&result_certs);
   ASSERT_EQ(1u, result_certs.size());
   ASSERT_EQ(result_certs.front()->der_cert(), intermediate_cert->der_cert());
 
   cert_source_request->GetNext(&result_certs);
   EXPECT_EQ(1u, result_certs.size());
 }
 
 // TODO(eroman): Re-enable these tests!
 #if 0
 // AuthorityInfoAccess with two URIs, one is invalid, the other HTTP.
 TEST(CertIssuerSourceAiaTest, OneInvalidOneHttpAia) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_invalid_and_http_aia.pem", &cert));
   scoped_refptr<ParsedCertificate> intermediate_cert;
   ASSERT_TRUE(ReadTestCert("i2.pem", &intermediate_cert));
 
   StrictMock<MockIssuerCallback> mock_callback;
-  StrictMock<MockCertNetFetcherImpl> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcherImpl>> mock_fetcher(
+      new StrictMock<MockCertNetFetcherImpl>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(),
                                base::Bind(&MockIssuerCallback::Callback,
                                           base::Unretained(&mock_callback)),
                                &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   RequestManager* req_manager =
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia2/I2.foo"));
   ASSERT_TRUE(req_manager);
@@ skipping 23 matching lines @@
 // and the results are retrieved.
 TEST(CertIssuerSourceAiaTest, TwoAiaCompletedInSeries) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_two_aia.pem", &cert));
   scoped_refptr<ParsedCertificate> intermediate_cert;
   ASSERT_TRUE(ReadTestCert("i.pem", &intermediate_cert));
   scoped_refptr<ParsedCertificate> intermediate_cert2;
   ASSERT_TRUE(ReadTestCert("i2.pem", &intermediate_cert2));
 
   StrictMock<MockIssuerCallback> mock_callback;
-  StrictMock<MockCertNetFetcherImpl> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcherImpl>> mock_fetcher(
+      new StrictMock<MockCertNetFetcherImpl>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(),
                                base::Bind(&MockIssuerCallback::Callback,
                                           base::Unretained(&mock_callback)),
                                &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   RequestManager* req_manager =
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia/I.cer"));
   ASSERT_TRUE(req_manager);
@@ skipping 54 matching lines @@
 // supplied to the caller in the same batch.
 TEST(CertIssuerSourceAiaTest, TwoAiaCompletedBeforeGetNext) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_two_aia.pem", &cert));
   scoped_refptr<ParsedCertificate> intermediate_cert;
   ASSERT_TRUE(ReadTestCert("i.pem", &intermediate_cert));
   scoped_refptr<ParsedCertificate> intermediate_cert2;
   ASSERT_TRUE(ReadTestCert("i2.pem", &intermediate_cert2));
 
   StrictMock<MockIssuerCallback> mock_callback;
-  StrictMock<MockCertNetFetcherImpl> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcherImpl>> mock_fetcher(
+      new StrictMock<MockCertNetFetcherImpl>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(),
                                base::Bind(&MockIssuerCallback::Callback,
                                           base::Unretained(&mock_callback)),
                                &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   RequestManager* req_manager =
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia/I.cer"));
   ASSERT_TRUE(req_manager);
@@ skipping 50 matching lines @@
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_three_aia.pem", &cert));
   scoped_refptr<ParsedCertificate> intermediate_cert;
   ASSERT_TRUE(ReadTestCert("i.pem", &intermediate_cert));
   scoped_refptr<ParsedCertificate> intermediate_cert2;
   ASSERT_TRUE(ReadTestCert("i2.pem", &intermediate_cert2));
   scoped_refptr<ParsedCertificate> intermediate_cert3;
   ASSERT_TRUE(ReadTestCert("i3.pem", &intermediate_cert3));
 
   StrictMock<MockIssuerCallback> mock_callback;
-  StrictMock<MockCertNetFetcherImpl> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcherImpl>> mock_fetcher(
+      new StrictMock<MockCertNetFetcherImpl>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(),
                                base::Bind(&MockIssuerCallback::Callback,
                                           base::Unretained(&mock_callback)),
                                &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   RequestManager* req_manager =
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia/I.cer"));
   ASSERT_TRUE(req_manager);
@@ skipping 54 matching lines @@
 }
 
 // AuthorityInfoAccess with a single HTTP url pointing to a single DER cert,
 // CertNetFetcher request fails.  The callback should be called to indicate the
 // request is complete, but no results should be provided.
 TEST(CertIssuerSourceAiaTest, OneAiaHttpError) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_one_aia.pem", &cert));
 
   StrictMock<MockIssuerCallback> mock_callback;
-  StrictMock<MockCertNetFetcherImpl> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcherImpl>> mock_fetcher(
+      new StrictMock<MockCertNetFetcherImpl>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(),
                                base::Bind(&MockIssuerCallback::Callback,
                                           base::Unretained(&mock_callback)),
                                &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   RequestManager* req_manager =
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia/I.cer"));
   ASSERT_TRUE(req_manager);
@@ skipping 12 matching lines @@
 
 // AuthorityInfoAccess with a single HTTP url pointing to a single DER cert,
 // CertNetFetcher request completes, but the DER cert fails to parse.  The
 // callback should be called to indicate the request is complete, but no results
 // should be provided.
 TEST(CertIssuerSourceAiaTest, OneAiaParseError) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_one_aia.pem", &cert));
 
   StrictMock<MockIssuerCallback> mock_callback;
-  StrictMock<MockCertNetFetcherImpl> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcherImpl>> mock_fetcher(
+      new StrictMock<MockCertNetFetcherImpl>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(),
                                base::Bind(&MockIssuerCallback::Callback,
                                           base::Unretained(&mock_callback)),
                                &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   RequestManager* req_manager =
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia/I.cer"));
   ASSERT_TRUE(req_manager);
@@ skipping 13 matching lines @@
 // AuthorityInfoAccess with two HTTP urls, each pointing to a single DER cert.
 // One request fails. No callback should be generated yet. Once the second
 // request completes, the callback should occur.
 TEST(CertIssuerSourceAiaTest, TwoAiaCompletedInSeriesFirstFails) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_two_aia.pem", &cert));
   scoped_refptr<ParsedCertificate> intermediate_cert2;
   ASSERT_TRUE(ReadTestCert("i2.pem", &intermediate_cert2));
 
   StrictMock<MockIssuerCallback> mock_callback;
-  StrictMock<MockCertNetFetcherImpl> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcherImpl>> mock_fetcher(
+      new StrictMock<MockCertNetFetcherImpl>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(),
                                base::Bind(&MockIssuerCallback::Callback,
                                           base::Unretained(&mock_callback)),
                                &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   RequestManager* req_manager =
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia/I.cer"));
   ASSERT_TRUE(req_manager);
@@ skipping 32 matching lines @@
 // First request completes, result is retrieved, then the second request fails.
 // The second callback should occur to indicate that the results are exhausted,
 // even though no more results are available.
 TEST(CertIssuerSourceAiaTest, TwoAiaCompletedInSeriesSecondFails) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_two_aia.pem", &cert));
   scoped_refptr<ParsedCertificate> intermediate_cert;
   ASSERT_TRUE(ReadTestCert("i.pem", &intermediate_cert));
 
   StrictMock<MockIssuerCallback> mock_callback;
-  StrictMock<MockCertNetFetcherImpl> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcherImpl>> mock_fetcher(
+      new StrictMock<MockCertNetFetcherImpl>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(),
                                base::Bind(&MockIssuerCallback::Callback,
                                           base::Unretained(&mock_callback)),
                                &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   RequestManager* req_manager =
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia/I.cer"));
   ASSERT_TRUE(req_manager);
@@ skipping 36 matching lines @@
   EXPECT_FALSE(result_cert.get());
 }
 
 // AuthorityInfoAccess with two HTTP urls. Request is cancelled before any HTTP
 // requests finish.
 TEST(CertIssuerSourceAiaTest, CertSourceRequestCancelled) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_two_aia.pem", &cert));
 
   StrictMock<MockIssuerCallback> mock_callback;
-  StrictMock<MockCertNetFetcherImpl> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcherImpl>> mock_fetcher(
+      new StrictMock<MockCertNetFetcherImpl>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(),
                                base::Bind(&MockIssuerCallback::Callback,
                                           base::Unretained(&mock_callback)),
                                &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   RequestManager* req_manager =
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia/I.cer"));
   ASSERT_TRUE(req_manager);
@@ skipping 14 matching lines @@
 // AuthorityInfoAccess with two HTTP urls, each pointing to a single DER cert.
 // One request completes, results are retrieved, then request is cancelled
 // before the second HTTP request completes.
 TEST(CertIssuerSourceAiaTest, TwoAiaOneCompletedThenRequestCancelled) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_two_aia.pem", &cert));
   scoped_refptr<ParsedCertificate> intermediate_cert;
   ASSERT_TRUE(ReadTestCert("i.pem", &intermediate_cert));
 
   StrictMock<MockIssuerCallback> mock_callback;
-  StrictMock<MockCertNetFetcherImpl> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcherImpl>> mock_fetcher(
+      new StrictMock<MockCertNetFetcherImpl>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(),
                                base::Bind(&MockIssuerCallback::Callback,
                                           base::Unretained(&mock_callback)),
                                &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   RequestManager* req_manager =
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia/I.cer"));
   ASSERT_TRUE(req_manager);
@@ skipping 29 matching lines @@
   EXPECT_FALSE(req_manager2->is_request_alive());
 }
 
 // AuthorityInfoAccess with six HTTP URLs.  kMaxFetchesPerCert is 5, so the
 // sixth URL should be ignored.
 TEST(CertIssuerSourceAiaTest, MaxFetchesPerCert) {
   scoped_refptr<ParsedCertificate> cert;
   ASSERT_TRUE(ReadTestCert("target_six_aia.pem", &cert));
 
   StrictMock<MockIssuerCallback> mock_callback;
-  StrictMock<MockCertNetFetcherImpl> mock_fetcher;
-  CertIssuerSourceAia aia_source(&mock_fetcher);
+  scoped_refptr<StrictMock<MockCertNetFetcherImpl>> mock_fetcher(
+      new StrictMock<MockCertNetFetcherImpl>());
+  CertIssuerSourceAia aia_source(mock_fetcher);
   std::unique_ptr<CertIssuerSource::Request> cert_source_request;
   aia_source.AsyncGetIssuersOf(cert.get(),
                                base::Bind(&MockIssuerCallback::Callback,
                                           base::Unretained(&mock_callback)),
                                &cert_source_request);
   ASSERT_NE(nullptr, cert_source_request);
 
   RequestManager* req_manager =
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia/I.cer"));
   ASSERT_TRUE(req_manager);
@@ skipping 22 matching lines @@
   // Sixth URL should not have created a request.
   EXPECT_FALSE(
       mock_fetcher.GetRequestManagerForURL(GURL("http://url-for-aia6/I6.foo")));
 }
 
 #endif
 
 }  // namespace
 
 }  // namespace net