Fix use after free bug by calling GetTokenService in Core's ctor.

google_apis/gaia/oauth2_token_service_request_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "google_apis/gaia/oauth2_token_service_request.h"
 
 #include <set>
 #include <string>
 #include <vector>
 #include "base/threading/thread.h"
@@ skipping 141 matching lines @@
   class Provider : public OAuth2TokenServiceRequest::TokenServiceProvider {
    public:
     Provider(const scoped_refptr<base::SingleThreadTaskRunner>& task_runner,
              OAuth2TokenService* token_service);
 
     virtual scoped_refptr<base::SingleThreadTaskRunner>
         GetTokenServiceTaskRunner() OVERRIDE;
     virtual OAuth2TokenService* GetTokenService() OVERRIDE;
 
    private:
+    virtual ~Provider();
+
     scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
     OAuth2TokenService* token_service_;
   };
 
   base::MessageLoop ui_loop_;
   OAuth2TokenService::ScopeSet scopes_;
   scoped_ptr<MockOAuth2TokenService> oauth2_service_;
-  scoped_ptr<OAuth2TokenServiceRequest::TokenServiceProvider> provider_;
+  scoped_refptr<OAuth2TokenServiceRequest::TokenServiceProvider> provider_;
   TestingOAuth2TokenServiceConsumer consumer_;
 };
 
 void OAuth2TokenServiceRequestTest::SetUp() {
   scopes_.insert(kScope);
   oauth2_service_.reset(new MockOAuth2TokenService);
   oauth2_service_->AddAccount(kAccountId);
-  provider_.reset(
-      new Provider(base::MessageLoopProxy::current(), oauth2_service_.get()));
+  provider_ =
+      new Provider(base::MessageLoopProxy::current(), oauth2_service_.get());
 }
 
 void OAuth2TokenServiceRequestTest::TearDown() {
   // Run the loop to execute any pending tasks that may free resources.
   ui_loop_.RunUntilIdle();
 }
 
 OAuth2TokenServiceRequestTest::Provider::Provider(
     const scoped_refptr<base::SingleThreadTaskRunner>& task_runner,
     OAuth2TokenService* token_service)
     : task_runner_(task_runner), token_service_(token_service) {
 }
 
 scoped_refptr<base::SingleThreadTaskRunner>
 OAuth2TokenServiceRequestTest::Provider::GetTokenServiceTaskRunner() {
   return task_runner_;
 }
 
 OAuth2TokenService* OAuth2TokenServiceRequestTest::Provider::GetTokenService() {
   return token_service_;
 }
 
+OAuth2TokenServiceRequestTest::Provider::~Provider() {
+}
+
 TEST_F(OAuth2TokenServiceRequestTest, CreateAndStart_Failure) {
   oauth2_service_->SetResponse(
       GoogleServiceAuthError(GoogleServiceAuthError::SERVICE_UNAVAILABLE),
       std::string(),
       base::Time());
   scoped_ptr<OAuth2TokenServiceRequest> request(
       OAuth2TokenServiceRequest::CreateAndStart(
           provider_.get(), kAccountId, scopes_, &consumer_));
   ui_loop_.RunUntilIdle();
   EXPECT_EQ(0, consumer_.num_get_token_success_);
@@ skipping 43 matching lines @@
   OAuth2TokenServiceRequest::InvalidateToken(
       provider_.get(), kAccountId, scopes_, kAccessToken);
   ui_loop_.RunUntilIdle();
   EXPECT_EQ(0, consumer_.num_get_token_success_);
   EXPECT_EQ(0, consumer_.num_get_token_failure_);
   EXPECT_EQ(kAccessToken, oauth2_service_->last_token_invalidated());
   EXPECT_EQ(1, oauth2_service_->num_invalidate_token());
 }
 
 }  // namespace