ExtensionsTest: Move initialization to SetUp and avoid potential UAF.
ExtensionsTest does all its initialization in its constructor but destroys its
initialized instances in TearDown(). This CL moves all the initialization logic
to its SetUp() method to make the initialization consistent with destruction.
The ExtensionsTest subclasses which rely on the current initialization sequence
are also modified.
Also, currently the extensions_browser_client_ instance is reset in TearDown()
but not unset as the singleton until the destructor. This can cause use after
free errors. This is also fixed by resetting the singleton instances in
TearDown() itself.
BUG=708256
Review-Url: https://codereview.chromium.org/2802433004
Cr-Commit-Position: refs/heads/master@{#463854}
diff --git a/extensions/browser/api/bluetooth/bluetooth_event_router_unittest.cc b/extensions/browser/api/bluetooth/bluetooth_event_router_unittest.cc
index 2b402d5a..474a85e 100644
--- a/extensions/browser/api/bluetooth/bluetooth_event_router_unittest.cc
+++ b/extensions/browser/api/bluetooth/bluetooth_event_router_unittest.cc
@@ -8,6 +8,7 @@
#include <string>
#include <utility>
+#include "base/memory/ptr_util.h"
#include "base/memory/ref_counted.h"
#include "base/run_loop.h"
#include "content/public/test/test_browser_context.h"
@@ -40,8 +41,12 @@
class BluetoothEventRouterTest : public ExtensionsTest {
public:
BluetoothEventRouterTest()
- : mock_adapter_(new testing::StrictMock<device::MockBluetoothAdapter>()),
- router_(new BluetoothEventRouter(browser_context())) {
+ : mock_adapter_(new testing::StrictMock<device::MockBluetoothAdapter>()) {
+ }
+
+ void SetUp() override {
+ ExtensionsTest::SetUp();
+ router_ = base::MakeUnique<BluetoothEventRouter>(browser_context());
router_->SetAdapterForTest(mock_adapter_);
}
diff --git a/extensions/browser/api/file_handlers/mime_util_unittest.cc b/extensions/browser/api/file_handlers/mime_util_unittest.cc
index 758134e..6c8fb39 100644
--- a/extensions/browser/api/file_handlers/mime_util_unittest.cc
+++ b/extensions/browser/api/file_handlers/mime_util_unittest.cc
@@ -55,6 +55,7 @@
~FileHandlersMimeUtilTest() override {}
void SetUp() override {
+ ExtensionsTest::SetUp();
file_system_context_ = content::CreateFileSystemContextForTesting(
NULL, browser_context()->GetPath());
diff --git a/extensions/browser/extensions_test.cc b/extensions/browser/extensions_test.cc
index e3aaba3..7cec642 100644
--- a/extensions/browser/extensions_test.cc
+++ b/extensions/browser/extensions_test.cc
@@ -32,24 +32,21 @@
namespace extensions {
-// This class does work in the constructor instead of SetUp() to give subclasses
-// a valid BrowserContext to use while initializing their members. For example:
-//
-// class MyExtensionsTest : public ExtensionsTest {
-// MyExtensionsTest()
-// : my_object_(browser_context())) {
-// }
-// };
-// TODO(crbug.com/708256): All these instances are setup in the constructor, but
-// destroyed in TearDown(), which may cause problems. Move this initialization
-// to SetUp().
-ExtensionsTest::ExtensionsTest()
- : content_browser_client_(new TestContentBrowserClient),
- content_utility_client_(new TestContentUtilityClient),
- browser_context_(new content::TestBrowserContext),
- incognito_context_(CreateTestIncognitoContext()),
- extensions_browser_client_(
- new TestExtensionsBrowserClient(browser_context_.get())) {
+ExtensionsTest::ExtensionsTest() {}
+
+ExtensionsTest::~ExtensionsTest() {
+ content::SetBrowserClientForTesting(nullptr);
+ content::SetUtilityClientForTesting(nullptr);
+}
+
+void ExtensionsTest::SetUp() {
+ content_browser_client_ = base::MakeUnique<TestContentBrowserClient>();
+ content_utility_client_ = base::MakeUnique<TestContentUtilityClient>();
+ browser_context_ = base::MakeUnique<content::TestBrowserContext>();
+ incognito_context_ = CreateTestIncognitoContext();
+ extensions_browser_client_ =
+ base::MakeUnique<TestExtensionsBrowserClient>(browser_context_.get());
+
BrowserContextDependencyManager::GetInstance()->MarkBrowserContextLive(
browser_context_.get());
content::SetBrowserClientForTesting(content_browser_client_.get());
@@ -78,15 +75,7 @@
ExtensionPrefsFactory::GetInstance()->SetInstanceForTesting(
browser_context(), std::move(extension_prefs));
-}
-ExtensionsTest::~ExtensionsTest() {
- ExtensionsBrowserClient::Set(nullptr);
- content::SetBrowserClientForTesting(nullptr);
- content::SetUtilityClientForTesting(nullptr);
-}
-
-void ExtensionsTest::SetUp() {
// Crashing here? Don't use this class in Chrome's unit_tests. See header.
BrowserContextDependencyManager::GetInstance()
->CreateBrowserContextServicesForTest(browser_context_.get());
@@ -99,10 +88,9 @@
BrowserContextDependencyManager::GetInstance()->DestroyBrowserContextServices(
browser_context_.get());
- // TODO(crbug.com/708256): |extension_browser_client_| is reset here but not
- // unset as the singleton until the destructor. This can lead to use after
- // free errors.
extensions_browser_client_.reset();
+ ExtensionsBrowserClient::Set(nullptr);
+
browser_context_.reset();
incognito_context_.reset();
pref_service_.reset();
diff --git a/extensions/browser/lazy_background_task_queue_unittest.cc b/extensions/browser/lazy_background_task_queue_unittest.cc
index ae2c41b..be75177 100644
--- a/extensions/browser/lazy_background_task_queue_unittest.cc
+++ b/extensions/browser/lazy_background_task_queue_unittest.cc
@@ -114,6 +114,7 @@
protected:
void SetUp() override {
+ ExtensionsTest::SetUp();
user_prefs::UserPrefs::Set(browser_context(), &testing_pref_service_);
}
diff --git a/extensions/browser/policy_check_unittest.cc b/extensions/browser/policy_check_unittest.cc
index 8b8af30..7d192b4 100644
--- a/extensions/browser/policy_check_unittest.cc
+++ b/extensions/browser/policy_check_unittest.cc
@@ -66,16 +66,16 @@
class PolicyCheckTest : public ExtensionsTest {
public:
- PolicyCheckTest() {
- // Replace the MockExtensionSystemFactory set by ExtensionsTest.
- extensions_browser_client()->set_extension_system_factory(&factory_);
- }
+ PolicyCheckTest() {}
~PolicyCheckTest() override {}
void SetUp() override {
ExtensionsTest::SetUp();
+ // Replace the MockExtensionSystemFactory set by ExtensionsTest.
+ extensions_browser_client()->set_extension_system_factory(&factory_);
+
base::DictionaryValue manifest_dict;
manifest_dict.SetString("name", "dummy name");
manifest_dict.SetString("version", "1");
diff --git a/extensions/browser/process_manager_unittest.cc b/extensions/browser/process_manager_unittest.cc
index 1bc35076..8057631 100644
--- a/extensions/browser/process_manager_unittest.cc
+++ b/extensions/browser/process_manager_unittest.cc
@@ -5,6 +5,7 @@
#include "extensions/browser/process_manager.h"
#include "base/macros.h"
+#include "base/memory/ptr_util.h"
#include "content/public/browser/content_browser_client.h"
#include "content/public/browser/notification_service.h"
#include "content/public/browser/site_instance.h"
@@ -55,16 +56,21 @@
class ProcessManagerTest : public ExtensionsTest {
public:
- ProcessManagerTest() : extension_registry_(browser_context()) {
+ ProcessManagerTest() {}
+
+ ~ProcessManagerTest() override {}
+
+ void SetUp() override {
+ ExtensionsTest::SetUp();
+ extension_registry_ =
+ base::MakeUnique<ExtensionRegistry>(browser_context());
extensions_browser_client()->set_process_manager_delegate(
&process_manager_delegate_);
}
- ~ProcessManagerTest() override {}
-
// Use original_context() to make it clear it is a non-incognito context.
BrowserContext* original_context() { return browser_context(); }
- ExtensionRegistry* extension_registry() { return &extension_registry_; }
+ ExtensionRegistry* extension_registry() { return extension_registry_.get(); }
TestProcessManagerDelegate* process_manager_delegate() {
return &process_manager_delegate_;
}
@@ -79,7 +85,8 @@
}
private:
- ExtensionRegistry extension_registry_; // Shared between BrowserContexts.
+ std::unique_ptr<ExtensionRegistry>
+ extension_registry_; // Shared between BrowserContexts.
TestProcessManagerDelegate process_manager_delegate_;
DISALLOW_COPY_AND_ASSIGN(ProcessManagerTest);
diff --git a/extensions/browser/updater/update_service_unittest.cc b/extensions/browser/updater/update_service_unittest.cc
index 402ab02..3c03909 100644
--- a/extensions/browser/updater/update_service_unittest.cc
+++ b/extensions/browser/updater/update_service_unittest.cc
@@ -148,10 +148,7 @@
class UpdateServiceTest : public ExtensionsTest {
public:
- UpdateServiceTest() {
- extensions_browser_client()->set_extension_system_factory(
- &fake_extension_system_factory_);
- }
+ UpdateServiceTest() {}
~UpdateServiceTest() override {}
void SetUp() override {
@@ -159,6 +156,8 @@
browser_threads_.reset(new content::TestBrowserThreadBundle(
content::TestBrowserThreadBundle::DEFAULT));
+ extensions_browser_client()->set_extension_system_factory(
+ &fake_extension_system_factory_);
extensions_browser_client()->SetUpdateClientFactory(base::Bind(
&UpdateServiceTest::CreateUpdateClient, base::Unretained(this)));
