New issue
Advanced search Search tips

Issue 708256 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Apr 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

ExtensionsTest: Move code from constructor to SetUp methods.

Project Member Reported by karandeepb@chromium.org, Apr 4 2017

Issue description

ExtensionsTest does all its initialization in its constructor but destroys its initialized instances in TearDown(). This can lead to problems.

Also, the extensions_browser_client_ instance is reset in TearDown but not unset as the singleton until the destructor which can cause use after free errors.
 
Description: Show this description
Summary: ExtensionsTest: Move code from constructor to SetUp methods. (was: ExtensionTest: Move code from constructor to SetUp methods.)
Description: Show this description
Project Member

Comment 4 by bugdroid1@chromium.org, Apr 12 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/fb19fb99a92bd5335dd24dde693e64f8ced55cbf

commit fb19fb99a92bd5335dd24dde693e64f8ced55cbf
Author: karandeepb <karandeepb@chromium.org>
Date: Wed Apr 12 00:23:20 2017

ExtensionsTest: Move initialization to SetUp and avoid potential UAF.

ExtensionsTest does all its initialization in its constructor but destroys its
initialized instances in TearDown(). This CL moves all the initialization logic
to its SetUp() method to make the initialization consistent with destruction.
The ExtensionsTest subclasses which rely on the current initialization sequence
are also modified.

Also, currently the extensions_browser_client_ instance is reset in TearDown()
but not unset as the singleton until the destructor. This can cause use after
free errors. This is also fixed by resetting the singleton instances in
TearDown() itself.

BUG= 708256 

Review-Url: https://codereview.chromium.org/2802433004
Cr-Commit-Position: refs/heads/master@{#463854}

[modify] https://crrev.com/fb19fb99a92bd5335dd24dde693e64f8ced55cbf/extensions/browser/api/bluetooth/bluetooth_event_router_unittest.cc
[modify] https://crrev.com/fb19fb99a92bd5335dd24dde693e64f8ced55cbf/extensions/browser/api/file_handlers/mime_util_unittest.cc
[modify] https://crrev.com/fb19fb99a92bd5335dd24dde693e64f8ced55cbf/extensions/browser/extensions_test.cc
[modify] https://crrev.com/fb19fb99a92bd5335dd24dde693e64f8ced55cbf/extensions/browser/lazy_background_task_queue_unittest.cc
[modify] https://crrev.com/fb19fb99a92bd5335dd24dde693e64f8ced55cbf/extensions/browser/policy_check_unittest.cc
[modify] https://crrev.com/fb19fb99a92bd5335dd24dde693e64f8ced55cbf/extensions/browser/process_manager_unittest.cc
[modify] https://crrev.com/fb19fb99a92bd5335dd24dde693e64f8ced55cbf/extensions/browser/updater/update_service_unittest.cc

Status: Fixed (was: Assigned)

Sign in to add a comment