net: fix multiple use-after-scope issues in net_unittests.

net/spdy/spdy_network_transaction_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cmath>
 #include <memory>
 #include <string>
 #include <utility>
 #include <vector>
 
@@ skipping 496 matching lines @@
   }
 
   static void DeleteSessionCallback(NormalSpdyTransactionHelper* helper,
                                     int result) {
     helper->ResetTrans();
   }
 
   static void StartTransactionCallback(HttpNetworkSession* session,
                                        GURL url,
                                        int result) {
+    HttpRequestInfo request;
     HttpNetworkTransaction trans(DEFAULT_PRIORITY, session);
     TestCompletionCallback callback;
-    HttpRequestInfo request;
     request.method = "GET";
     request.url = url;
     request.load_flags = 0;
     int rv = trans.Start(&request, callback.callback(), NetLogWithSource());
     EXPECT_THAT(rv, IsError(ERR_IO_PENDING));
     callback.WaitForResult();
   }
 
   ChunkedUploadDataStream* upload_chunked_data_stream() const {
     return upload_chunked_data_stream_.get();
@@ skipping 163 matching lines @@
   TransactionHelperResult out;
   NormalSpdyTransactionHelper helper(CreateGetRequest(), DEFAULT_PRIORITY,
                                      NetLogWithSource(), nullptr);
   helper.RunPreTestSetup();
   helper.AddData(&data);
   // We require placeholder data because three get requests are sent out at
   // the same time which results in three sockets being connected. The first
   // on will negotiate SPDY and will be used for all requests.
   helper.AddData(&data_placeholder1);
   helper.AddData(&data_placeholder2);
-  HttpNetworkTransaction trans1(DEFAULT_PRIORITY, helper.session());
-  HttpNetworkTransaction trans2(DEFAULT_PRIORITY, helper.session());
-  HttpNetworkTransaction trans3(DEFAULT_PRIORITY, helper.session());
-
   TestCompletionCallback callback1;
   TestCompletionCallback callback2;
   TestCompletionCallback callback3;
 
   HttpRequestInfo httpreq1 = CreateGetRequest();
   HttpRequestInfo httpreq2 = CreateGetRequest();
   HttpRequestInfo httpreq3 = CreateGetRequest();
 
+  HttpNetworkTransaction trans1(DEFAULT_PRIORITY, helper.session());
+  HttpNetworkTransaction trans2(DEFAULT_PRIORITY, helper.session());
+  HttpNetworkTransaction trans3(DEFAULT_PRIORITY, helper.session());
+
   out.rv = trans1.Start(&httpreq1, callback1.callback(), log);
   ASSERT_THAT(out.rv, IsError(ERR_IO_PENDING));
   out.rv = trans2.Start(&httpreq2, callback2.callback(), log);
   ASSERT_THAT(out.rv, IsError(ERR_IO_PENDING));
   out.rv = trans3.Start(&httpreq3, callback3.callback(), log);
   ASSERT_THAT(out.rv, IsError(ERR_IO_PENDING));
 
   out.rv = callback1.WaitForResult();
   ASSERT_THAT(out.rv, IsOk());
   out.rv = callback3.WaitForResult();
@@ skipping 1898 matching lines @@
   // Start the ordinary requests.
   NetLogWithSource log;
   ASSERT_THAT(trans1.Start(&CreateGetRequest(), callback1.callback(), log),
               IsError(ERR_IO_PENDING));
   ASSERT_THAT(trans3.Start(&CreateGetRequest(), callback3.callback(), log),
               IsError(ERR_IO_PENDING));
   ASSERT_THAT(trans5.Start(&CreateGetRequest(), callback5.callback(), log),
               IsError(ERR_IO_PENDING));
   data.RunUntilPaused();
 
-  HttpNetworkTransaction trans2(HIGHEST, helper.session());
-  TestCompletionCallback callback2;
-
   // Start a request that matches the push.
   HttpRequestInfo push_req = CreateGetRequest();
   push_req.url = GURL(GetDefaultUrlWithPath("/foo.dat"));
+
+  HttpNetworkTransaction trans2(HIGHEST, helper.session());
+  TestCompletionCallback callback2;
   ASSERT_THAT(trans2.Start(&push_req, callback2.callback(), log),
               IsError(ERR_IO_PENDING));
   data.Resume();
 
   base::RunLoop().RunUntilIdle();
   ASSERT_THAT(callback1.WaitForResult(), IsOk());
   ASSERT_THAT(callback2.WaitForResult(), IsOk());
   ASSERT_THAT(callback3.WaitForResult(), IsOk());
   ASSERT_THAT(callback5.WaitForResult(), IsOk());
   helper.VerifyDataConsumed();
@@ skipping 2784 matching lines @@
   data.Resume();
   EXPECT_THAT(callback.WaitForResult(), IsOk());
 
   // And now we can allow everything else to run to completion.
   data.Resume();
   base::RunLoop().RunUntilIdle();
   EXPECT_THAT(callback2.WaitForResult(), IsOk());
   EXPECT_THAT(callback3.WaitForResult(), IsOk());
 
   helper.VerifyDataConsumed();
+
+  // At this point the test is completed and we need to safely destroy
+  // all allocated structures. Helper stores a transaction that has a
+  // reference to a stack allocated request, which has a short lifetime,
+  // and is accessed during the transaction destruction. We need to delete
+  // the transaction while the request is still a valid object.
+  helper.ResetTrans();
 }
 
 // Test that sent data frames and received WINDOW_UPDATE frames change
 // the send_window_size_ correctly.
 
 // WINDOW_UPDATE is different than most other frames in that it can arrive
 // while the client is still sending the request body.  In order to enforce
 // this scenario, we feed a couple of dummy frames and give a delay of 0 to
 // socket data provider, so that initial read that is done as soon as the
 // stream is created, succeeds and schedules another read.  This way reads
@@ skipping 1091 matching lines @@
 TEST_F(SpdyNetworkTransactionTLSUsageCheckTest, TLSCipherSuiteSucky) {
   std::unique_ptr<SSLSocketDataProvider> ssl_provider(
       new SSLSocketDataProvider(ASYNC, OK));
   // Set to TLS_RSA_WITH_NULL_MD5
   SSLConnectionStatusSetCipherSuite(0x1, &ssl_provider->connection_status);
 
   RunTLSUsageCheckTest(std::move(ssl_provider));
 }
 
 }  // namespace net