Cast: Fix use after free in a testing tool

media/cast/test/simulator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Simulate end to end streaming.
 //
 // Input:
 // --source=
 //   WebM used as the source of video and audio frames.
 // --output=
@@ skipping 265 matching lines @@
   const IPPModel& ipp_model = model.ipp();
 
   std::vector<double> average_rates(ipp_model.average_rate_size());
   std::copy(ipp_model.average_rate().begin(), ipp_model.average_rate().end(),
       average_rates.begin());
   test::InterruptedPoissonProcess ipp(average_rates,
       ipp_model.coef_burstiness(), ipp_model.coef_variance(), 0);
 
   // Connect sender to receiver. This initializes the pipe.
   receiver_to_sender.Initialize(
-      ipp.NewBuffer(128 * 1024), transport_sender->PacketReceiverForTesting(),
+      ipp.NewBuffer(128 * 1024).Pass(),

[miu, 2014/08/13 22:33:45]

Huh.  Weird.  I'm surprised it compiled the way it was.

+      transport_sender->PacketReceiverForTesting(),
       task_runner, &testing_clock);
   sender_to_receiver.Initialize(
-      ipp.NewBuffer(128 * 1024), cast_receiver->packet_receiver(), task_runner,
+      ipp.NewBuffer(128 * 1024).Pass(),
+      cast_receiver->packet_receiver(), task_runner,
       &testing_clock);
 
   // Start receiver.
   int audio_frame_count = 0;
   int video_frame_count = 0;
   cast_receiver->RequestDecodedVideoFrame(
       base::Bind(&GotVideoFrame, &video_frame_count, cast_receiver.get()));
   cast_receiver->RequestDecodedAudioFrame(
       base::Bind(&GotAudioFrame, &audio_frame_count, cast_receiver.get()));
 
@@ skipping 209 matching lines @@
   values.SetBoolean("sim", true);
   values.SetString("sim-id", sim_id);
 
   std::string extra_data;
   base::JSONWriter::Write(&values, &extra_data);
 
   // Run.
   media::cast::RunSimulation(source_path, output_path, extra_data, model);
   return 0;
 }