diff options
| author | amistry <amistry@chromium.org> | 2015-10-18 17:36:28 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-10-19 00:37:01 +0000 |
| commit | 8c0dcbf1a027cc854463b499a2c6037ace82e9e6 (patch) | |
| tree | 4dce2e7f64a261842c94fc4eea4cc559a7495b7d /net | |
| parent | bcca911e2c100c95c012a9e7859ebb79d57a8f76 (diff) | |
| download | chromium_src-8c0dcbf1a027cc854463b499a2c6037ace82e9e6.zip chromium_src-8c0dcbf1a027cc854463b499a2c6037ace82e9e6.tar.gz chromium_src-8c0dcbf1a027cc854463b499a2c6037ace82e9e6.tar.bz2 | |
Disconnect |client_| in |QuicTestClient|'s destructor.
The destructor of |client_| ends up calling back into |QuicTestClient|
via QuicTestClient::OnClose(). This function then accesses members of
|QuicTestClient| which may no longer be valid. Specifically, it accesses
|client_| which is a scoped_ptr member in the process of being destructed.
unique_ptr in libc++ (which we want to replace scoped_ptr with) sets its
value to nullptr before deleting the object, and therefore reading
|client_| ends up reading a nullptr, and causes a null pointer
dereference.
BUG=535321
Review URL: https://codereview.chromium.org/1408393002
Cr-Commit-Position: refs/heads/master@{#354714}
Diffstat (limited to 'net')
| -rw-r--r-- | net/tools/quic/test_tools/quic_test_client.cc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/tools/quic/test_tools/quic_test_client.cc b/net/tools/quic/test_tools/quic_test_client.cc index 503a7c1..37fcd0c 100644 --- a/net/tools/quic/test_tools/quic_test_client.cc +++ b/net/tools/quic/test_tools/quic_test_client.cc @@ -191,6 +191,7 @@ QuicTestClient::~QuicTestClient() { if (stream_) { stream_->set_visitor(nullptr); } + client_->Disconnect(); } void QuicTestClient::Initialize(bool secure) { |