Fixes possible use after free in SessionService

chrome/browser/sessions/session_service_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/scoped_vector.h"
 #include "base/path_service.h"
+#include "base/run_loop.h"
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/synchronization/waitable_event.h"
 #include "base/time/time.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/defaults.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/sessions/session_backend.h"
 #include "chrome/browser/sessions/session_service.h"
 #include "chrome/browser/sessions/session_service_test_helper.h"
 #include "chrome/browser/sessions/session_types.h"
 #include "chrome/common/chrome_paths.h"
@@ skipping 132 matching lines @@
         window2_id, Browser::TYPE_TABBED, SessionService::TYPE_NORMAL);
     service()->SetWindowBounds(window2_id,
                                window2_bounds,
                                ui::SHOW_STATE_MAXIMIZED);
     helper_.PrepareTabInWindow(window2_id, tab2_id, 0, true);
     UpdateNavigation(window2_id, tab2_id, *nav2, true);
   }
 
   SessionService* service() { return helper_.service(); }
 
-  SessionBackend* backend() { return helper_.backend(); }
-
   const gfx::Rect window_bounds;
 
   SessionID window_id;
 
   int sync_save_count_;
 
   // Path used in testing.
   base::ScopedTempDir temp_dir_;
   base::FilePath path_;
 
@@ skipping 813 matching lines @@
 
   ASSERT_EQ(1U, windows.size());
   ASSERT_EQ(0, windows[0]->selected_tab_index);
   ASSERT_EQ(window_id.id(), windows[0]->window_id.id());
   ASSERT_EQ(1U, windows[0]->tabs.size());
 
   SessionTab* tab = windows[0]->tabs[0];
   helper_.AssertTabEquals(window_id, tab_id, 0, 0, 1, *tab);
   helper_.AssertNavigationEquals(nav1, tab->navigations[0]);
 }
+
+// Functions used by GetSessionsAndDestroy.
+namespace {
+
+void OnGotPreviousSession(ScopedVector<SessionWindow> windows,
+                          SessionID::id_type ignored_active_window) {
+  FAIL() << "SessionService was destroyed, this shouldn't be reached.";
+}
+
+void PostBackToThread(base::MessageLoop* message_loop,
+                      base::RunLoop* run_loop) {
+  message_loop->PostTask(FROM_HERE,
+                         base::Bind(&base::RunLoop::Quit,
+                                    base::Unretained(run_loop)));
+}
+
+}  // namespace
+
+// Verifies that SessionService::GetLastSession() works correctly if the
+// SessionService is deleted during processing. To verify the problematic case
+// does the following:
+// 1. Sends a task to the background thread that blocks.
+// 2. Asks SessionService for the last session commands. This is blocked by 1.
+// 3. Posts another task to the background thread, this too is blocked by 1.
+// 4. Deletes SessionService.
+// 5. Signals the semaphore that 2 and 3 are waiting on, allowing
+//    GetLastSession() to continue.
+// 6. runs the message loop, this is quit when the task scheduled in 3 posts
+//    back to the ui thread to quit the run loop.
+// The call to get the previous session should never be invoked because the
+// SessionService was destroyed before SessionService could process the results.
+TEST_F(SessionServiceTest, GetSessionsAndDestroy) {
+  base::CancelableTaskTracker cancelable_task_tracker;
+  base::RunLoop run_loop;
+  base::WaitableEvent event(true, false);
+  helper_.RunTaskOnBackendThread(FROM_HERE,
+                                 base::Bind(&base::WaitableEvent::Wait,
+                                            base::Unretained(&event)));
+  service()->GetLastSession(base::Bind(&OnGotPreviousSession),
+                            &cancelable_task_tracker);
+  helper_.RunTaskOnBackendThread(
+      FROM_HERE,
+      base::Bind(&PostBackToThread,
+                 base::Unretained(base::MessageLoop::current()),
+                 base::Unretained(&run_loop)));
+  delete helper_.ReleaseService();
+  event.Signal();
+  run_loop.Run();
+}