Remove ScopedVector from tools/ipc_fuzzer/.

tools/ipc_fuzzer/fuzzer/fuzzer.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <iostream>
 #include <set>
 #include <string>
 #include <tuple>
 #include <utility>
 #include <vector>
@@ skipping 1118 matching lines @@
 template <>
 struct FuzzTraits<HWND> {
   static bool Fuzz(HWND* p, Fuzzer* fuzzer) {
     // TODO(aarya): This should actually do something.
     return true;
   }
 };
 #endif
 
 template <>
-struct FuzzTraits<IPC::Message> {
-  static bool Fuzz(IPC::Message* p, Fuzzer* fuzzer) {
+struct FuzzTraits<std::unique_ptr<IPC::Message>> {
+  static bool Fuzz(std::unique_ptr<IPC::Message> p, Fuzzer* fuzzer) {
     // TODO(mbarbella): Support mutation.
     if (!fuzzer->ShouldGenerate())
       return true;
 
     if (g_function_vector.empty())
       return false;
     size_t index = RandInRange(g_function_vector.size());
-    IPC::Message* ipc_message = (*g_function_vector[index])(NULL, fuzzer);
+    std::unique_ptr<IPC::Message> ipc_message =
+        (*g_function_vector[index])(nullptr, fuzzer);
     if (!ipc_message)
       return false;
-    p = ipc_message;
+    p = std::move(ipc_message);

[Tom Sepez, 2017/07/10 17:45:47]

This doesn't look right even in the old code. But here, we make a message,
assign it to P, and then P goes out of scope and we delete it?

[Avi (use Gerrit), 2017/07/10 18:44:00]

My brain was mostly focused on getting this to compile, but you're right. I'd
been thinking that p was being used as an in/out param, but it's not.

What is going on here? How is this fuzzer even working?

Lemme try to change this to something reasonable. The FuzzTraits template takes
a pointer to the thing to fuzz, so this should be a pointer-to-unique_ptr, yes?

[Tom Sepez, 2017/07/10 18:45:10]

SGTM.

[Avi (use Gerrit), 2017/07/10 18:46:44]

This is done in the latest patch; PTAL.

     return true;
   }
 };
 
 #if !defined(OS_WIN)
 // PlatformfileForTransit is just SharedMemoryHandle on Windows, which already
 // has a trait, see ipc/ipc_platform_file.h
 template <>
 struct FuzzTraits<IPC::PlatformFileForTransit> {
   static bool Fuzz(IPC::PlatformFileForTransit* p, Fuzzer* fuzzer) {
@@ skipping 565 matching lines @@
 
 // MessageFactory abstracts away constructing control/routed messages by
 // providing an additional random routing ID argument when necessary.
 template <typename Message, IPC::MessageKind>
 class MessageFactory;
 
 template <typename Message>
 class MessageFactory<Message, IPC::MessageKind::CONTROL> {
  public:
   template <typename... Args>
-  static Message* New(const Args&... args) {
-    return new Message(args...);
+  static std::unique_ptr<Message> New(const Args&... args) {
+    return base::MakeUnique<Message>(args...);
   }
 };
 
 template <typename Message>
 class MessageFactory<Message, IPC::MessageKind::ROUTED> {
  public:
   template <typename... Args>
-  static Message* New(const Args&... args) {
-    return new Message(RandInRange(MAX_FAKE_ROUTING_ID), args...);
+  static std::unique_ptr<Message> New(const Args&... args) {
+    return base::MakeUnique<Message>(RandInRange(MAX_FAKE_ROUTING_ID), args...);
   }
 };
 
 template <typename Message>
 class FuzzerHelper;
 
 template <typename Meta, typename... Ins>
 class FuzzerHelper<IPC::MessageT<Meta, std::tuple<Ins...>, void>> {
  public:
   using Message = IPC::MessageT<Meta, std::tuple<Ins...>, void>;
 
-  static IPC::Message* Fuzz(IPC::Message* msg, Fuzzer* fuzzer) {
+  static std::unique_ptr<IPC::Message> Fuzz(IPC::Message* msg, Fuzzer* fuzzer) {
     return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>());
   }
 
  private:
   template <size_t... Ns>
-  static IPC::Message* FuzzImpl(IPC::Message* msg,
-                                Fuzzer* fuzzer,
-                                base::IndexSequence<Ns...>) {
+  static std::unique_ptr<IPC::Message> FuzzImpl(IPC::Message* msg,
+                                                Fuzzer* fuzzer,
+                                                base::IndexSequence<Ns...>) {
     typename Message::Param p;
     if (msg) {
       Message::Read(static_cast<Message*>(msg), &p);
     }
     if (FuzzParam(&p, fuzzer)) {
       return MessageFactory<Message, Meta::kKind>::New(std::get<Ns>(p)...);
     }
     std::cerr << "Don't know how to handle " << Meta::kName << "\n";
     return nullptr;
   }
 };
 
 template <typename Meta, typename... Ins, typename... Outs>
 class FuzzerHelper<
     IPC::MessageT<Meta, std::tuple<Ins...>, std::tuple<Outs...>>> {
  public:
   using Message = IPC::MessageT<Meta, std::tuple<Ins...>, std::tuple<Outs...>>;
 
-  static IPC::Message* Fuzz(IPC::Message* msg, Fuzzer* fuzzer) {
+  static std::unique_ptr<IPC::Message> Fuzz(IPC::Message* msg, Fuzzer* fuzzer) {
     return FuzzImpl(msg, fuzzer, base::MakeIndexSequence<sizeof...(Ins)>());
   }
 
  private:
   template <size_t... Ns>
-  static IPC::Message* FuzzImpl(IPC::Message* msg,
-                                Fuzzer* fuzzer,
-                                base::IndexSequence<Ns...>) {
+  static std::unique_ptr<IPC::Message> FuzzImpl(IPC::Message* msg,
+                                                Fuzzer* fuzzer,
+                                                base::IndexSequence<Ns...>) {
     typename Message::SendParam p;
     Message* real_msg = static_cast<Message*>(msg);
-    Message* new_msg = nullptr;
+    std::unique_ptr<Message> new_msg;
     if (real_msg) {
       Message::ReadSendParam(real_msg, &p);
     }
     if (FuzzParam(&p, fuzzer)) {
       new_msg = MessageFactory<Message, Meta::kKind>::New(
           std::get<Ns>(p)..., static_cast<Outs*>(nullptr)...);
     }
     if (real_msg && new_msg) {
-      MessageCracker::CopyMessageID(new_msg, real_msg);
+      MessageCracker::CopyMessageID(new_msg.get(), real_msg);
     } else if (!new_msg) {
       std::cerr << "Don't know how to handle " << Meta::kName << "\n";
     }
     return new_msg;
   }
 };
 
 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h"
 
 void PopulateFuzzerFunctionVector(
     FuzzerFunctionVector* function_vector) {
 #undef IPC_MESSAGE_DECL
 #define IPC_MESSAGE_DECL(name, ...) \
   function_vector->push_back(FuzzerHelper<name>::Fuzz);
 #include "tools/ipc_fuzzer/message_lib/all_messages.h"
 }
 
 // Redefine macros to register fuzzing functions into map.
 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h"
 #undef IPC_MESSAGE_DECL
 #define IPC_MESSAGE_DECL(name, ...) \
   (*map)[static_cast<uint32_t>(name::ID)] = FuzzerHelper<name>::Fuzz;
 
 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) {
 #include "tools/ipc_fuzzer/message_lib/all_messages.h"
 }
 
 }  // namespace ipc_fuzzer