Fix stack corruption bug in FilePathWatcherTest.Callback.

base/files/file_path_watcher_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/files/file_path_watcher.h"
 
 #include <set>
 
 #if defined(OS_WIN)
 #include <windows.h>
 #include <aclapi.h>
 #elif defined(OS_POSIX)
 #include <sys/stat.h>
 #endif
 
 #include "base/basictypes.h"
 #include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/compiler_specific.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/message_loop.h"
 #include "base/message_loop_proxy.h"
 #include "base/path_service.h"
 #include "base/scoped_temp_dir.h"
 #include "base/stl_util.h"
 #include "base/stringprintf.h"
 #include "base/synchronization/waitable_event.h"
@@ skipping 224 matching lines @@
   FilePathWatcher watcher;
   scoped_refptr<TestDelegate> delegate(new TestDelegate(collector()));
   ASSERT_TRUE(SetupWatch(test_file(), &watcher, delegate.get()));
 
   // Now make sure we get notified if the file is deleted.
   file_util::Delete(test_file(), false);
   ASSERT_TRUE(WaitForEvents());
 }
 
 TEST_F(FilePathWatcherTest, Callback) {
-  FilePathWatcher watcher;
+  FilePathWatcher* watcher = new FilePathWatcher();
   bool called_back = false;
 
   MessageLoop* file_loop = file_thread_.message_loop();
   ASSERT_TRUE(file_loop);
   // The callback makes |loop_| quit on file events, and flips |called_back|
   // to true.
   FilePathWatcher::Callback callback = base::Bind(
       QuitLoopWatchCallback, &loop_, test_file(), false, &called_back);
 
   // Start watching on the file thread, and unblock the loop once the callback
   // has been installed.
   file_thread_.message_loop_proxy()->PostTaskAndReply(
       FROM_HERE,
-      base::Bind(SetupWatchCallback, test_file(), &watcher, callback),
+      base::Bind(SetupWatchCallback, test_file(), watcher, callback),
       base::Bind(&MessageLoop::Quit, base::Unretained(&loop_)));
   loop_.Run();
 
   // The watch has been installed. Trigger a file event now, which will unblock
   // the loop again.
   ASSERT_TRUE(WriteFile(test_file(), "content"));
   loop_.Run();
   EXPECT_TRUE(called_back);
+
+  // Multiple events might have triggered, meaning that multiple
+  // QuitLoopWatchCallback have been posted. The FilePathWatcher can only cancel
+  // on the FILE thread, and thus that callback might still trigger after this
+  // function returns. Make sure the |watcher| is deleted before returning and
+  // destroying |called_back|.
+  // A better fix requires significant changes to the FilePathWatcher.

[Mattias Nissler (ping if slow), 2012/08/30 19:09:31]

TODO + bug.

+  file_thread_.message_loop_proxy()->DeleteSoon(FROM_HERE, watcher);
+  file_thread_.message_loop_proxy()->PostTaskAndReply(
+      FROM_HERE,
+      base::Bind(base::DoNothing),
+      base::Bind(&MessageLoop::Quit, base::Unretained(&loop_)));
+  loop_.Run();
 }
 
 // Used by the DeleteDuringNotify test below.
 // Deletes the FilePathWatcher when it's notified.
 class Deleter : public FilePathWatcher::Delegate {
  public:
   Deleter(FilePathWatcher* watcher, MessageLoop* loop)
       : watcher_(watcher),
         loop_(loop) {
   }
@@ skipping 525 matching lines @@
   ASSERT_TRUE(ChangeFilePermissions(test_dir1, Execute, false));
   ASSERT_TRUE(WaitForEvents());
   ASSERT_TRUE(ChangeFilePermissions(test_dir1, Execute, true));
 }
 
 #endif  // OS_MACOSX
 }  // namespace
 
 }  // namespace files
 }  // namespace base