Revert 88284 - Revert 88151 (see crbug.com/85296) - Fix user-after-free error with ObserverList. The problem is that if an ObserverListBase::Iterator is on the stack and one of the observers deletes the object holding the list, Iterator's destructor will use the deleted list.

Relanding 88151 now that sync fixes (88483, 88472) are in.

BUG=84919
Review URL: http://codereview.chromium.org/7127001

TBR=jam@chromium.org
Review URL: http://codereview.chromium.org/7134008

TBR=thakis@chromium.org
Review URL: http://codereview.chromium.org/7129036

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@88484 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 23 insertions, 0 deletions

diff --git a/base/observer_list_unittest.cc b/base/observer_list_unittest.cc
index 8315a2b..d0d2001 100644
--- a/base/observer_list_unittest.cc
+++ b/base/observer_list_unittest.cc
@@ -422,4 +422,27 @@ TEST(ObserverListTest, ClearNotifyExistingOnly) {
       << "Adder should not observe, so sum should still be 0.";
 }
 
+class ListDestructor : public Foo {
+ public:
+  explicit ListDestructor(ObserverList<Foo>* list) : list_(list) {}
+  virtual void Observe(int x) {
+    delete list_;
+  }
+  virtual ~ListDestructor() { }
+  int total;
+ private:
+  ObserverList<Foo>* list_;
+};
+
+
+TEST(ObserverListTest, IteratorOutlivesList) {
+  ObserverList<Foo>* observer_list = new ObserverList<Foo>;
+  ListDestructor a(observer_list);
+  observer_list->AddObserver(&a);
+
+  FOR_EACH_OBSERVER(Foo, *observer_list, Observe(0));
+  // If this test fails, there'll be Valgrind errors when this function goes out
+  // of scope.
+}
+
 }  // namespace