Temporarily CHECK use after free in Value

base/values.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/values.h"
 
 #include <string.h>
 
 #include <algorithm>
 #include <cmath>
@@ skipping 106 matching lines @@
       return;
     case Type::BINARY:
       binary_value_.Init();
       return;
     case Type::DICTIONARY:
       dict_ptr_.Init(MakeUnique<DictStorage>());
       return;
     case Type::LIST:
       list_.Init();
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): Remove.
+      CHECK(false);
+      return;
   }
 }
 
 Value::Value(bool in_bool) : type_(Type::BOOLEAN), bool_value_(in_bool) {}
 
 Value::Value(int in_int) : type_(Type::INTEGER), int_value_(in_int) {}
 
 Value::Value(double in_double) : type_(Type::DOUBLE), double_value_(in_double) {
   if (!std::isfinite(double_value_)) {
     NOTREACHED() << "Non-finite (i.e. NaN or positive/negative infinity) "
@@ skipping 56 matching lines @@
       InternalCleanup();
       InternalMoveConstructFrom(std::move(that));
     }
   }
 
   return *this;
 }
 
 Value::~Value() {
   InternalCleanup();
+  type_ = Type::DELETED;
 }
 
 // static
 const char* Value::GetTypeName(Value::Type type) {
   DCHECK_GE(static_cast<int>(type), 0);
   DCHECK_LT(static_cast<size_t>(type), arraysize(kTypeNames));
   return kTypeNames[static_cast<size_t>(type)];
 }
 
 bool Value::GetBool() const {
@@ skipping 222 matching lines @@
       if (list_->size() != other->list_->size())
         return false;
 
       return std::equal(std::begin(*list_), std::end(*list_),
                         std::begin(*(other->list_)),
                         [](const ListStorage::value_type& lhs,
                            const ListStorage::value_type& rhs) {
                           return lhs->Equals(rhs.get());
                         });
     }
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means a use-after-free.
+      CHECK(false);
+      return false;
   }
 
   NOTREACHED();
   return false;
 }
 
 // static
 bool Value::Equals(const Value* a, const Value* b) {
   if ((a == NULL) && (b == NULL)) return true;
   if ((a == NULL) ^  (b == NULL)) return false;
@@ skipping 41 matching lines @@
     // DictStorage and ListStorage are move-only types due to the presence of
     // unique_ptrs. This is why the call to |CreateDeepCopy| is necessary here.
     // TODO(crbug.com/646113): Clean this up when DictStorage and ListStorage
     // can be copied directly.
     case Type::DICTIONARY:
       dict_ptr_.Init(std::move(*that.CreateDeepCopy()->dict_ptr_));
       return;
     case Type::LIST:
       list_.Init(std::move(*that.CreateDeepCopy()->list_));
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means |that| is used after free.
+      CHECK(false);
+      return;
   }
 }
 
 void Value::InternalMoveConstructFrom(Value&& that) {
   type_ = that.type_;
 
   switch (type_) {
     case Type::NONE:
     case Type::BOOLEAN:
     case Type::INTEGER:
     case Type::DOUBLE:
       InternalCopyFundamentalValue(that);
       return;
 
     case Type::STRING:
       string_value_.InitFromMove(std::move(that.string_value_));
       return;
     case Type::BINARY:
       binary_value_.InitFromMove(std::move(that.binary_value_));
       return;
     case Type::DICTIONARY:
       dict_ptr_.InitFromMove(std::move(that.dict_ptr_));
       return;
     case Type::LIST:
       list_.InitFromMove(std::move(that.list_));
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means |that| is used after free.
+      CHECK(false);
+      return;
   }
 }
 
 void Value::InternalCopyAssignFromSameType(const Value& that) {
   CHECK_EQ(type_, that.type_);
 
   switch (type_) {
     case Type::NONE:
     case Type::BOOLEAN:
     case Type::INTEGER:
@@ skipping 10 matching lines @@
     // DictStorage and ListStorage are move-only types due to the presence of
     // unique_ptrs. This is why the call to |CreateDeepCopy| is necessary here.
     // TODO(crbug.com/646113): Clean this up when DictStorage and ListStorage
     // can be copied directly.
     case Type::DICTIONARY:
       *dict_ptr_ = std::move(*that.CreateDeepCopy()->dict_ptr_);
       return;
     case Type::LIST:
       *list_ = std::move(*that.CreateDeepCopy()->list_);
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means |that| is used after free.
+      CHECK(false);
+      return;
   }
 }
 
 void Value::InternalMoveAssignFromSameType(Value&& that) {
   CHECK_EQ(type_, that.type_);
 
   switch (type_) {
     case Type::NONE:
     case Type::BOOLEAN:
     case Type::INTEGER:
     case Type::DOUBLE:
       InternalCopyFundamentalValue(that);
       return;
 
     case Type::STRING:
       *string_value_ = std::move(*that.string_value_);
       return;
     case Type::BINARY:
       *binary_value_ = std::move(*that.binary_value_);
       return;
     case Type::DICTIONARY:
       *dict_ptr_ = std::move(*that.dict_ptr_);
       return;
     case Type::LIST:
       *list_ = std::move(*that.list_);
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means |that| is used after free.
+      CHECK(false);
+      return;
   }
 }
 
 void Value::InternalCleanup() {
   switch (type_) {
     case Type::NONE:
     case Type::BOOLEAN:
     case Type::INTEGER:
     case Type::DOUBLE:
       // Nothing to do
       return;
 
     case Type::STRING:
       string_value_.Destroy();
       return;
     case Type::BINARY:
       binary_value_.Destroy();
       return;
     case Type::DICTIONARY:
       dict_ptr_.Destroy();
       return;
     case Type::LIST:
       list_.Destroy();
       return;
+    case Type::DELETED:
+      // TODO(crbug.com/697817): This means a use-after-free.
+      CHECK(false);
+      return;
   }
 }
 
 ///////////////////// DictionaryValue ////////////////////
 
 // static
 std::unique_ptr<DictionaryValue> DictionaryValue::From(
     std::unique_ptr<Value> value) {
   DictionaryValue* out;
   if (value && value->GetAsDictionary(&out)) {
@@ skipping 733 matching lines @@
 }
 
 std::ostream& operator<<(std::ostream& out, const Value::Type& type) {
   if (static_cast<int>(type) < 0 ||
       static_cast<size_t>(type) >= arraysize(kTypeNames))
     return out << "Invalid Type (index = " << static_cast<int>(type) << ")";
   return out << Value::GetTypeName(type);
 }
 
 }  // namespace base