Fix invalid read in the ResourceTracker tests. It wasn't doing the proper

NPObject reference counting and was double-freeing the object.

TEST=tools/valgrind/chrome_tests.sh -t test_shell --gtest_filter="ResourceTrackerTest.*"
BUG=92279
Review URL: http://codereview.chromium.org/7658002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@96948 0039d316-1c4b-4281-b951-d872f2087c98

tools/valgrind/memcheck/suppressions.txt

@@ -3929,19 +3929,6 @@
    fun:_ZN7WebCore15GraphicsContext*EPNS_8GradientE
    fun:_ZN7WebCore15GraphicsContext*EN3WTF10PassRefPtrINS_8GradientEEE
 }
-{
-   bug_77258_a
-   Memcheck:Leak
-   fun:_Znw*
-   fun:_ZN6webkit5ppapi*22MessageChannelAllocateEP4_NPPP7NPClass
-   fun:_NPN_CreateObject
-   fun:_ZN6WebKit11WebBindings12createObjectEP4_NPPP7NPClass
-   ...
-   fun:_ZN6webkit5ppapi14MessageChannelC1EPNS0_14PluginInstanceE
-   ...
-   fun:_ZN6webkit5ppapi14PluginInstanceC1EPNS0_14PluginDelegateEPNS0_12PluginModuleEPK12PPP_Instance
-   fun:_ZN6webkit5ppapi*ResourceTrackerTest_*
-}
 {
    bug_77258_b
    Memcheck:Leak
@@ -5186,25 +5173,6 @@
    fun:_ZN14RunnableMethodIN3net16HostResolverImpl3JobEMS2_FvRKN4base9TimeTicksEjE6Tuple2IS4_jEE13ReleaseCalleeEv
    fun:_ZN14RunnableMethodIN3net16HostResolverImpl3JobEMS2_FvRKN4base9TimeTicksEjE6Tuple2IS4_jEED0Ev
 }
-{
-   bug_92279
-   Memcheck:Addr4
-   fun:_NPN_ReleaseObject
-   fun:_ZN6WebKit11WebBindings13releaseObjectEP8NPObject
-   fun:_ZN5ppapi11NPObjectVarD0Ev
-   fun:_ZNK4base10RefCountedIN5ppapi3VarEE7ReleaseEv
-   fun:_ZN13scoped_refptrIN5ppapi3Var*
-   ...
-   fun:_ZN5ppapi10VarTracker7VarInfoD1Ev
-   fun:_ZNSt4pairIKiN5ppapi10VarTracker7VarInfo*
-   ...
-   fun:_ZN9__gnu_cxx8hash_mapIiN5ppapi10VarTracker7VarInfoENS_4hashIiEESt8equal_toIiESaIS3_EED1Ev
-   fun:_ZN5ppapi10VarTracker*
-   ...
-   fun:_ZN6webkit5ppapi15ResourceTracker*
-   ...
-   fun:_ZN6webkit5ppapi19ResourceTrackerTest*
-}
 {
    bug_92389
    Memcheck:Leak

webkit/plugins/ppapi/resource_tracker_unittest.cc

@@ -8,6 +8,7 @@
 #include "ppapi/c/pp_var.h"
 #include "ppapi/c/ppp_instance.h"
 #include "third_party/npapi/bindings/npruntime.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebBindings.h"
 #include "webkit/plugins/ppapi/mock_plugin_delegate.h"
 #include "webkit/plugins/ppapi/mock_resource.h"
 #include "webkit/plugins/ppapi/npapi_glue.h"
@@ -44,6 +45,7 @@ int g_npobjects_alive = 0;
 
 void TrackedClassDeallocate(NPObject* npobject) {
   g_npobjects_alive--;
+  delete npobject;
 }
 
 NPClass g_tracked_npclass = {
@@ -61,7 +63,8 @@ NPClass g_tracked_npclass = {
   NULL,
 };
 
-// Returns a new tracked NPObject with a refcount of 1.
+// Returns a new tracked NPObject with a refcount of 1. You'll want to put this
+// in a NPObjectReleaser to free this ref when the test completes.
 NPObject* NewTrackedNPObject() {
   NPObject* object = new NPObject;
   object->_class = &g_tracked_npclass;
@@ -71,6 +74,17 @@ NPObject* NewTrackedNPObject() {
   return object;
 }
 
+class ReleaseNPObject {
+ public:
+  void operator()(NPObject* o) const {
+    WebKit::WebBindings::releaseObject(o);
+  }
+};
+
+// Handles automatically releasing a reference to the NPObject on destruction.
+// It's assumed the input has a ref already taken.
+typedef scoped_ptr_malloc<NPObject, ReleaseNPObject> NPObjectReleaser;
+
 }  // namespace
 
 // ResourceTrackerTest ---------------------------------------------------------
@@ -183,7 +197,7 @@ TEST_F(ResourceTrackerTest, DeleteObjectVarWithInstance) {
   PP_Instance pp_instance2 = instance2->pp_instance();
 
   // Make an object var.
-  scoped_ptr<NPObject> npobject(NewTrackedNPObject());
+  NPObjectReleaser npobject(NewTrackedNPObject());
   NPObjectToPPVar(instance2.get(), npobject.get());
 
   EXPECT_EQ(1, g_npobjects_alive);
@@ -197,7 +211,7 @@ TEST_F(ResourceTrackerTest, DeleteObjectVarWithInstance) {
 // Make sure that using the same NPObject should give the same PP_Var
 // each time.
 TEST_F(ResourceTrackerTest, ReuseVar) {
-  scoped_ptr<NPObject> npobject(NewTrackedNPObject());
+  NPObjectReleaser npobject(NewTrackedNPObject());
 
   PP_Var pp_object1 = NPObjectToPPVar(instance(), npobject.get());
   PP_Var pp_object2 = NPObjectToPPVar(instance(), npobject.get());