Add ScopedTaskScheduler in URLRequestDataJobFuzzerHarness.

net/url_request/url_request_data_job_fuzzer.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <memory>
 #include <string>
 
 #include "base/memory/ptr_util.h"
 #include "base/memory/singleton.h"
+#include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
 #include "base/test/fuzzed_data_provider.h"
+#include "base/test/scoped_task_scheduler.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "net/http/http_request_headers.h"
 #include "net/url_request/data_protocol_handler.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_job_factory_impl.h"
 #include "net/url_request/url_request_test_util.h"
 
 namespace {
 
 const size_t kMaxLengthForFuzzedRange = 32;
 
 }  // namespace
 
 // This class tests creating and reading to completion a URLRequest with fuzzed
 // input. The fuzzer provides a data: URL and optionally generates custom Range
 // headers. The amount of data read in each Read call is also fuzzed, as is
 // the size of the IOBuffer to read data into.
 class URLRequestDataJobFuzzerHarness : public net::URLRequest::Delegate {
  public:
   URLRequestDataJobFuzzerHarness()
-      : context_(true), task_runner_(base::ThreadTaskRunnerHandle::Get()) {
+      : task_runner_(base::ThreadTaskRunnerHandle::Get()),

[xunjieli, 2017/02/14 17:51:59]

Is the |task_runner_| still needed?
Can you post the task to the task scheduler?

[fdoray, 2017/02/14 18:24:30]

In fact, we don't even need to post a task in QuitLoop(). We can call
read_loop_->QuitWhenIdle() directly. Posting a task is useful to quit a loop
running on a different thread, but this fuzzer is single-threaded.

+        scoped_task_scheduler_(base::MessageLoop::current()),
+        context_(true) {
     job_factory_.SetProtocolHandler(
         "data", base::MakeUnique<net::DataProtocolHandler>());
     context_.set_job_factory(&job_factory_);
     context_.Init();
   }
 
   static URLRequestDataJobFuzzerHarness* GetInstance() {
     return base::Singleton<URLRequestDataJobFuzzerHarness>::get();
   }
 
@@ skipping 105 matching lines @@
     if (bytes_read > 0) {
       ReadFromRequest(request);
     } else {
       QuitLoop();
     }
   }
 
  private:
   friend struct base::DefaultSingletonTraits<URLRequestDataJobFuzzerHarness>;
 
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+  base::test::ScopedTaskScheduler scoped_task_scheduler_;

[xunjieli, 2017/02/14 16:17:37]

The requirement that every subclass needs a ScopedTaskScheduler is not
intuitive. Can you make URLRequestSimpleJob have a ScopedTaskScheduler instead?
It's clearer for the actual call places to have the ScopedTaskScheduler.

[fdoray, 2017/02/14 17:44:10]

A TaskScheduler must be registered in the current process to use a function from
base/task_scheduler/post_task.h (cf.
https://cs.chromium.org/chromium/src/base/task_scheduler/post_task.h?l=26).
ScopedTaskScheduler is a convenient way to register a TaskScheduler within a
scope. This is very similar to how MessageLoop works: you need to initialize a
MessageLoop in your test if it uses code that calls MessageLoop::current().

We can't add a base::test::ScopedTaskScheduler in URLRequestSimpleJob because:
- It can only be used in tests.
- There can only be one active TaskScheduler per process.

[xunjieli, 2017/02/14 17:51:59]

Acknowledged.

+
   net::TestURLRequestContext context_;
   net::URLRequestJobFactoryImpl job_factory_;
   std::vector<size_t> read_lengths_;
   scoped_refptr<net::IOBuffer> buf_;
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
   base::RunLoop* read_loop_;
 
   DISALLOW_COPY_AND_ASSIGN(URLRequestDataJobFuzzerHarness);
 };
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   // Using a static singleton test harness lets the test run ~3-4x faster.
   return URLRequestDataJobFuzzerHarness::GetInstance()
       ->CreateAndReadFromDataURLRequest(data, size);
 }