Fix stack corruption bug in FilePathWatcherTest.Callback.

base/files/file_path_watcher_browsertest.cc

Index: base/files/file_path_watcher_browsertest.cc
diff --git a/base/files/file_path_watcher_browsertest.cc b/base/files/file_path_watcher_browsertest.cc
index 5eea88c5fd7e0ce58fd3aea876098ca3173426b8..57679201fec968beb6dd172f12ac8bb10a971d4d 100644
--- a/base/files/file_path_watcher_browsertest.cc
+++ b/base/files/file_path_watcher_browsertest.cc
@@ -15,6 +15,7 @@
 
 #include "base/basictypes.h"
 #include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/compiler_specific.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
@@ -259,7 +260,7 @@ TEST_F(FilePathWatcherTest, DeletedFile) {
 }
 
 TEST_F(FilePathWatcherTest, Callback) {
-  FilePathWatcher watcher;
+  FilePathWatcher* watcher = new FilePathWatcher();
   bool called_back = false;
 
   MessageLoop* file_loop = file_thread_.message_loop();
@@ -273,7 +274,7 @@ TEST_F(FilePathWatcherTest, Callback) {
   // has been installed.
   file_thread_.message_loop_proxy()->PostTaskAndReply(
       FROM_HERE,
-      base::Bind(SetupWatchCallback, test_file(), &watcher, callback),
+      base::Bind(SetupWatchCallback, test_file(), watcher, callback),
       base::Bind(&MessageLoop::Quit, base::Unretained(&loop_)));
   loop_.Run();
 
@@ -282,6 +283,19 @@ TEST_F(FilePathWatcherTest, Callback) {
   ASSERT_TRUE(WriteFile(test_file(), "content"));
   loop_.Run();
   EXPECT_TRUE(called_back);
+
+  // Multiple events might have triggered, meaning that multiple
+  // QuitLoopWatchCallback have been posted. The FilePathWatcher can only cancel
+  // on the FILE thread, and thus that callback might still trigger after this
+  // function returns. Make sure the |watcher| is deleted before returning and
+  // destroying |called_back|.
+  // A better fix requires significant changes to the FilePathWatcher.

[Mattias Nissler (ping if slow), 2012/08/30 19:09:31]

TODO + bug.

+  file_thread_.message_loop_proxy()->DeleteSoon(FROM_HERE, watcher);
+  file_thread_.message_loop_proxy()->PostTaskAndReply(
+      FROM_HERE,
+      base::Bind(base::DoNothing),
+      base::Bind(&MessageLoop::Quit, base::Unretained(&loop_)));
+  loop_.Run();
 }
 
 // Used by the DeleteDuringNotify test below.