commit 87e7b3dd6c585b2009c051112777d4285d6bc844
author Tomas Gunnarsson <tommi@webrtc.org> Mon Jan 17 08:58:45 2022
committer WebRTC LUCI CQ <webrtc-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Jan 17 09:44:12 2022
tree 0d7d07f07388aa6266e8146a695d612fe3e8f50e
parent 42eec3db27e0d0e615c6b83413e2c676c3b265a8

Fix uaf issue in RepeatingTaskTest

Bug: none
Change-Id: Ic0e5fd1c50a45e4dde21c36925a84b5fa5bdbf8a
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/247120
Commit-Queue: Tomas Gunnarsson <tommi@webrtc.org>
Auto-Submit: Tomas Gunnarsson <tommi@webrtc.org>
Reviewed-by: Evan Shrubsole <eshr@webrtc.org>
Commit-Queue: Evan Shrubsole <eshr@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#35704}

rtc_base/task_utils/repeating_task_unittest.cc

diff --git a/rtc_base/task_utils/repeating_task_unittest.cc b/rtc_base/task_utils/repeating_task_unittest.cc
index 5c20f8f..ac0520a 100644
--- a/rtc_base/task_utils/repeating_task_unittest.cc
+++ b/rtc_base/task_utils/repeating_task_unittest.cc
@@ -101,6 +101,12 @@
   absl::optional<uint32_t> last_delay_;
 };
 
+// NOTE: Since this utility class holds a raw pointer to a variable that likely
+// lives on the stack, it's important that any repeating tasks that use this
+// class be explicitly stopped when the test criteria have been met. If the
+// task is not stopped, an instance of this class can be deleted when the
+// pointed-to MockClosure has been deleted and we end up trying to call a
+// virtual method on a deleted object in the dtor.
 class MoveOnlyClosure {
  public:
   explicit MoveOnlyClosure(MockClosure* mock) : mock_(mock) {}
@@ -236,25 +242,30 @@
 TEST(RepeatingTaskTest, ZeroReturnValueRepostsTheTask) {
   NiceMock<MockClosure> closure;
   rtc::Event done;
+  RepeatingTaskHandle handle;
   EXPECT_CALL(closure, Call())
       .WillOnce(Return(TimeDelta::Zero()))
-      .WillOnce(Invoke([&done] {
+      .WillOnce(Invoke([&] {
         done.Set();
+        handle.Stop();
         return kTimeout;
       }));
   TaskQueueForTest task_queue("queue");
-  RepeatingTaskHandle::Start(task_queue.Get(), MoveOnlyClosure(&closure));
+  handle =
+      RepeatingTaskHandle::Start(task_queue.Get(), MoveOnlyClosure(&closure));
   EXPECT_TRUE(done.Wait(kTimeout.ms()));
 }
 
 TEST(RepeatingTaskTest, StartPeriodicTask) {
   MockFunction<TimeDelta()> closure;
   rtc::Event done;
+  RepeatingTaskHandle handle;
   EXPECT_CALL(closure, Call())
       .WillOnce(Return(TimeDelta::Millis(20)))
       .WillOnce(Return(TimeDelta::Millis(20)))
-      .WillOnce(Invoke([&done] {
+      .WillOnce(Invoke([&] {
         done.Set();
+        handle.Stop();
         return kTimeout;
       }));
   TaskQueueForTest task_queue("queue");