1 files changed, 33 insertions, 0 deletions
diff --git a/net/url_request/url_request_unittest.cc b/net/url_request/url_request_unittest.cc
index d68175b..afa2c6c 100644
--- a/net/url_request/url_request_unittest.cc
+++ b/net/url_request/url_request_unittest.cc
@@ -36,6 +36,7 @@
 #include "net/proxy/proxy_service.h"
 #include "net/socket/ssl_test_util.h"
 #include "net/url_request/url_request.h"
+#include "net/url_request/url_request_file_dir_job.h"
 #include "net/url_request/url_request_test_job.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
@@ -1011,6 +1012,38 @@ TEST_F(URLRequestTest, FileDirCancelTest) {
   net::NetModule::SetResourceProvider(NULL);
 }
 
+TEST_F(URLRequestTest, FileDirRedirectNoCrash) {
+  // There is an implicit redirect when loading a file path that matches a
+  // directory and does not end with a slash.  Ensure that following such
+  // redirects does not crash.  See http://crbug.com/18686.
+
+  FilePath path;
+  PathService::Get(base::DIR_SOURCE_ROOT, &path);
+  path = path.Append(FILE_PATH_LITERAL("net"));
+  path = path.Append(FILE_PATH_LITERAL("data"));
+  path = path.Append(FILE_PATH_LITERAL("url_request_unittest"));
+
+  TestDelegate d;
+  d.set_quit_on_redirect(true);
+  TestURLRequest req(net::FilePathToFileURL(path), &d);
+  req.Start();
+  MessageLoop::current()->Run();
+
+  // Let the directory lister have time to finish its work, which will
+  // cause the URLRequestFileDirJob's ref count to drop to 1.
+  URLRequestFileDirJob* job = static_cast<URLRequestFileDirJob*>(req.job());
+  while (!job->list_complete()) {
+    PlatformThread::Sleep(10);
+    MessageLoop::current()->RunAllPending();
+  }
+
+  // Should not crash during this call!
+  req.FollowDeferredRedirect();
+
+  // Flush event queue.
+  MessageLoop::current()->RunAllPending();
+}
+
 TEST_F(URLRequestTestHTTP, RestrictRedirects) {
   ASSERT_TRUE(NULL != server_.get());