Fix use-after-free in StructuredMetricsServiceTest teardown.
A set of StructuredMetricsServiceTests were failing on ChromeOS builds
after attempting to update protobuf to v32. The upgrade introduced a new
memory-safety check in generated proto destructors which exposed a
latent use-after-free bug during the test's teardown sequence, resulting
in a crash.
The root cause of the crash was a race condition in the test fixture's
teardown logic. On ChromeOS, the StructuredMetricsService has a more
complex, multi-threaded architecture that uses asynchronous tasks for
cleanup. The test fixture's member variables were declared in an order
that caused the object responsible for managing task execution
(base::test::TaskEnvironment) to be destroyed *before* the service that
was posting tasks to it. This led to a race where cleanup tasks could
run after their required resources had already been deallocated,
causing memory corruption.
This CL resolves the race condition by restructuring the test fixture to
follow correct RAII principles for asynchronous tests. The member
variables are reordered to guarantee that the TaskEnvironment is
destroyed last, ensuring it outlives all other members and can flush
their asynchronous tasks. In addition, the service and its dependencies
are ordered to guarantee their lifetimes are correctly managed. The
manual teardown logic is removed in favor of this robust, automatic
cleanup.
[email protected]
Bug: 439656514
Cq-Include-Trybots: luci.chromium.try:linux-chromeos-dbg
Change-Id: I5cccf88fad10c6abf450ad4a7e5271fbdbdb625a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6866551
Reviewed-by: Roger McFarlane <[email protected]>
Commit-Queue: Tommy Nyquist <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1504198}
NOKEYCHECK=True
GitOrigin-RevId: 0cbd506a1712a02f9abad68492bf5aba8b7d54e8
1 file changed
