Safebrowsing: Fix crash if DownloadItem is destroyed before history check.

chrome/browser/safe_browsing/download_protection_service_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/safe_browsing/download_protection_service.h"
 
 #include <map>
 #include <string>
 
 #include "base/base_paths.h"
@@ skipping 32 matching lines @@
 
 #if defined(OS_MACOSX)
 #include "base/metrics/field_trial.h"
 #include "components/variations/entropy_provider.h"
 #endif
 
 using ::testing::Assign;
 using ::testing::ContainerEq;
 using ::testing::DoAll;
 using ::testing::ElementsAre;
+using ::testing::Invoke;
 using ::testing::Mock;
 using ::testing::NotNull;
 using ::testing::Return;
 using ::testing::ReturnRef;
 using ::testing::SaveArg;
 using ::testing::StrictMock;
 using ::testing::_;
 using base::MessageLoop;
 using content::BrowserThread;
 namespace safe_browsing {
@@ skipping 1529 matching lines @@
   EXPECT_FALSE(HasClientDownloadRequest());
 #endif
 }
 
 TEST_F(DownloadProtectionServiceTest, TestDownloadItemDestroyed) {
   net::TestURLFetcherFactory factory;
 
   std::vector<GURL> url_chain;
   url_chain.push_back(GURL("http://www.evil.com/bla.exe"));
   GURL referrer("http://www.google.com/");
+  GURL tab_url("http://www.google.com/tab");
   base::FilePath tmp_path(FILE_PATH_LITERAL("a.tmp"));
   base::FilePath final_path(FILE_PATH_LITERAL("a.exe"));
   std::string hash = "hash";
 
   {
     content::MockDownloadItem item;
     EXPECT_CALL(item, GetFullPath()).WillRepeatedly(ReturnRef(tmp_path));
     EXPECT_CALL(item, GetTargetFilePath())
         .WillRepeatedly(ReturnRef(final_path));
     EXPECT_CALL(item, GetUrlChain()).WillRepeatedly(ReturnRef(url_chain));
     EXPECT_CALL(item, GetReferrerUrl()).WillRepeatedly(ReturnRef(referrer));
-    EXPECT_CALL(item, GetTabUrl()).WillRepeatedly(ReturnRef(GURL::EmptyGURL()));
+    EXPECT_CALL(item, GetTabUrl()).WillRepeatedly(ReturnRef(tab_url));
     EXPECT_CALL(item, GetTabReferrerUrl())
         .WillRepeatedly(ReturnRef(GURL::EmptyGURL()));
     EXPECT_CALL(item, GetHash()).WillRepeatedly(ReturnRef(hash));
     EXPECT_CALL(item, GetReceivedBytes()).WillRepeatedly(Return(100));
     EXPECT_CALL(item, HasUserGesture()).WillRepeatedly(Return(true));
     EXPECT_CALL(item, GetRemoteAddress()).WillRepeatedly(Return(""));
 
     EXPECT_CALL(*sb_service_->mock_database_manager(),
                 MatchDownloadWhitelistUrl(_))
         .WillRepeatedly(Return(false));
     EXPECT_CALL(*binary_feature_extractor_.get(), CheckSignature(tmp_path, _));
     EXPECT_CALL(*binary_feature_extractor_.get(),
                 ExtractImageHeaders(tmp_path, _));
 
     download_service_->CheckClientDownload(
         &item,
         base::Bind(&DownloadProtectionServiceTest::SyncCheckDoneCallback,
                    base::Unretained(this)));
     // MockDownloadItem going out of scope triggers the OnDownloadDestroyed
     // notification.
   }
 
   EXPECT_TRUE(IsResult(DownloadProtectionService::UNKNOWN));
   EXPECT_FALSE(HasClientDownloadRequest());
 }
 
+TEST_F(DownloadProtectionServiceTest,
+       TestDownloadItemDestroyedDuringWhitelistCheck) {
+  net::TestURLFetcherFactory factory;
+
+  std::vector<GURL> url_chain;
+  url_chain.push_back(GURL("http://www.evil.com/bla.exe"));
+  GURL referrer("http://www.google.com/");
+  GURL tab_url("http://www.google.com/tab");
+  base::FilePath tmp_path(FILE_PATH_LITERAL("a.tmp"));
+  base::FilePath final_path(FILE_PATH_LITERAL("a.exe"));
+  std::string hash = "hash";
+
+  scoped_ptr<content::MockDownloadItem> item(new content::MockDownloadItem);
+  EXPECT_CALL(*item, GetFullPath()).WillRepeatedly(ReturnRef(tmp_path));
+  EXPECT_CALL(*item, GetTargetFilePath())
+      .WillRepeatedly(ReturnRef(final_path));
+  EXPECT_CALL(*item, GetUrlChain()).WillRepeatedly(ReturnRef(url_chain));
+  EXPECT_CALL(*item, GetReferrerUrl()).WillRepeatedly(ReturnRef(referrer));
+  EXPECT_CALL(*item, GetTabUrl()).WillRepeatedly(ReturnRef(tab_url));
+  EXPECT_CALL(*item, GetTabReferrerUrl())
+      .WillRepeatedly(ReturnRef(GURL::EmptyGURL()));
+  EXPECT_CALL(*item, GetHash()).WillRepeatedly(ReturnRef(hash));
+  EXPECT_CALL(*item, GetReceivedBytes()).WillRepeatedly(Return(100));
+  EXPECT_CALL(*item, HasUserGesture()).WillRepeatedly(Return(true));
+  EXPECT_CALL(*item, GetRemoteAddress()).WillRepeatedly(Return(""));
+
+  EXPECT_CALL(*sb_service_->mock_database_manager(),
+              MatchDownloadWhitelistUrl(_))
+      .WillRepeatedly(Invoke([&item](const GURL&) {
+        item.reset();
+        return false;
+      }));
+  EXPECT_CALL(*binary_feature_extractor_.get(), CheckSignature(tmp_path, _));
+  EXPECT_CALL(*binary_feature_extractor_.get(),
+              ExtractImageHeaders(tmp_path, _));
+
+  download_service_->CheckClientDownload(
+      item.get(),
+      base::Bind(&DownloadProtectionServiceTest::CheckDoneCallback,
+                 base::Unretained(this)));
+
+  MessageLoop::current()->Run();
+  EXPECT_TRUE(IsResult(DownloadProtectionService::UNKNOWN));
+  EXPECT_FALSE(HasClientDownloadRequest());
+}
+
 TEST_F(DownloadProtectionServiceTest, GetCertificateWhitelistStrings) {
   // We'll pass this cert in as the "issuer", even though it isn't really
   // used to sign the certs below.  GetCertificateWhitelistStirngs doesn't care
   // about this.
   scoped_refptr<net::X509Certificate> issuer_cert(
       ReadTestCertificate("issuer.pem"));
   ASSERT_TRUE(issuer_cert.get());
   std::string cert_base = "cert/" + base::HexEncode(
       issuer_cert->fingerprint().data,
       sizeof(issuer_cert->fingerprint().data));
@@ skipping 66 matching lines @@
   EXPECT_THAT(whitelist_strings, ElementsAre(cert_base + "/OU=unit"));
 
   cert = ReadTestCertificate("test_c.pem");
   ASSERT_TRUE(cert.get());
   whitelist_strings.clear();
   GetCertificateWhitelistStrings(
       *cert.get(), *issuer_cert.get(), &whitelist_strings);
   EXPECT_THAT(whitelist_strings, ElementsAre());
 }
 }  // namespace safe_browsing