ExtensionsTest: Move initialization to SetUp and avoid potential UAF.

extensions/browser/extensions_test.cc

Index: extensions/browser/extensions_test.cc
diff --git a/extensions/browser/extensions_test.cc b/extensions/browser/extensions_test.cc
index e3aaba37c62f98e78f7ad04637b4ee50492a0d6e..7cec642c64d263441cc67b704b5ceb145e1d2d8d 100644
--- a/extensions/browser/extensions_test.cc
+++ b/extensions/browser/extensions_test.cc
@@ -32,24 +32,21 @@ std::unique_ptr<content::TestBrowserContext> CreateTestIncognitoContext() {
 
 namespace extensions {
 
-// This class does work in the constructor instead of SetUp() to give subclasses
-// a valid BrowserContext to use while initializing their members. For example:
-//
-// class MyExtensionsTest : public ExtensionsTest {
-//   MyExtensionsTest()
-//     : my_object_(browser_context())) {
-//   }
-// };
-// TODO(crbug.com/708256): All these instances are setup in the constructor, but
-// destroyed in TearDown(), which may cause problems. Move this initialization
-// to SetUp().
-ExtensionsTest::ExtensionsTest()
-    : content_browser_client_(new TestContentBrowserClient),
-      content_utility_client_(new TestContentUtilityClient),
-      browser_context_(new content::TestBrowserContext),
-      incognito_context_(CreateTestIncognitoContext()),
-      extensions_browser_client_(
-          new TestExtensionsBrowserClient(browser_context_.get())) {
+ExtensionsTest::ExtensionsTest() {}
+
+ExtensionsTest::~ExtensionsTest() {
+  content::SetBrowserClientForTesting(nullptr);

[karandeepb, 2017/04/10 22:26:23]

I also tried to move:
  content::SetBrowserClientForTesting(nullptr);
  content::SetUtilityClientForTesting(nullptr);
to the TearDown() method but it led to failure of a single test:
IdentityApiTest.GetAuthToken. IdentityApiTest inherits from ApiUnitTest which
has a TestBrowserThreadBundle instance. 

The destructor of TestBrowserThreadBundle relies on an active
ContentBrowserClient, which causes the test failure for PS2. 

But resetting the TestBrowserThreadBundle in ApiUnitTest::TearDown doesn't
simply solve the issue. After destructing TestBrowserThreadBundle, the UI thread
is stopped and the current thread is not the UI thread (not sure if this is a
bug). The destructor of a BrowserContext relies on the current thread being UI. 

So for the current behavior, the destruction order needs to be:
-> Browser context, TestBrowserThreadBundle, ContentBrowserClient.

+  content::SetUtilityClientForTesting(nullptr);
+}
+
+void ExtensionsTest::SetUp() {
+  content_browser_client_ = base::MakeUnique<TestContentBrowserClient>();
+  content_utility_client_ = base::MakeUnique<TestContentUtilityClient>();
+  browser_context_ = base::MakeUnique<content::TestBrowserContext>();
+  incognito_context_ = CreateTestIncognitoContext();
+  extensions_browser_client_ =
+      base::MakeUnique<TestExtensionsBrowserClient>(browser_context_.get());
+
   BrowserContextDependencyManager::GetInstance()->MarkBrowserContextLive(
       browser_context_.get());
   content::SetBrowserClientForTesting(content_browser_client_.get());
@@ -78,15 +75,7 @@ ExtensionsTest::ExtensionsTest()
 
   ExtensionPrefsFactory::GetInstance()->SetInstanceForTesting(
       browser_context(), std::move(extension_prefs));
-}
 
-ExtensionsTest::~ExtensionsTest() {
-  ExtensionsBrowserClient::Set(nullptr);
-  content::SetBrowserClientForTesting(nullptr);
-  content::SetUtilityClientForTesting(nullptr);
-}
-
-void ExtensionsTest::SetUp() {
   // Crashing here? Don't use this class in Chrome's unit_tests. See header.
   BrowserContextDependencyManager::GetInstance()
       ->CreateBrowserContextServicesForTest(browser_context_.get());
@@ -99,10 +88,9 @@ void ExtensionsTest::TearDown() {
   BrowserContextDependencyManager::GetInstance()->DestroyBrowserContextServices(
       browser_context_.get());
 
-  // TODO(crbug.com/708256): |extension_browser_client_| is reset here but not
-  // unset as the singleton until the destructor. This can lead to use after
-  // free errors.
   extensions_browser_client_.reset();
+  ExtensionsBrowserClient::Set(nullptr);
+
   browser_context_.reset();
   incognito_context_.reset();
   pref_service_.reset();