Add some instrumentation to investigate a possible UAF.

BUG=467797

Review URL: https://codereview.chromium.org/1017913003

Cr-Commit-Position: refs/heads/master@{#321274}

net/base/net_log.cc

@@ -5,6 +5,9 @@
 #include "net/base/net_log.h"
 
 #include "base/bind.h"
+#ifdef TEMP_INSTRUMENTATION_467797
+#include "base/debug/alias.h"
+#endif
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
@@ -398,8 +401,22 @@ void NetLog::AddEntry(EventType type,
   FOR_EACH_OBSERVER(ThreadSafeObserver, observers_, OnAddEntryData(entry_data));
 }
 
+BoundNetLog::~BoundNetLog() {
+#ifdef TEMP_INSTRUMENTATION_467797
+  liveness_ = DEAD;
+  stack_trace_ = base::debug::StackTrace();
+
+  // Probably not necessary, but just in case compiler tries to optimize out the
+  // writes to liveness_ and stack_trace_.
+  base::debug::Alias(&liveness_);
+  base::debug::Alias(&stack_trace_);
+#endif
+}
+
 void BoundNetLog::AddEntry(NetLog::EventType type,
                            NetLog::EventPhase phase) const {
+  CrashIfInvalid();
+
   if (!net_log_)
     return;
   net_log_->AddEntry(type, source_, phase, NULL);
@@ -409,6 +426,8 @@ void BoundNetLog::AddEntry(
     NetLog::EventType type,
     NetLog::EventPhase phase,
     const NetLog::ParametersCallback& get_parameters) const {
+  CrashIfInvalid();
+
   if (!net_log_)
     return;
   net_log_->AddEntry(type, source_, phase, &get_parameters);
@@ -471,6 +490,8 @@ void BoundNetLog::AddByteTransferEvent(NetLog::EventType event_type,
 }
 
 NetLog::LogLevel BoundNetLog::GetLogLevel() const {
+  CrashIfInvalid();
+
   if (net_log_)
     return net_log_->GetLogLevel();
   return NetLog::LOG_NONE;
@@ -494,4 +515,22 @@ BoundNetLog BoundNetLog::Make(NetLog* net_log,
   return BoundNetLog(source, net_log);
 }
 
+void BoundNetLog::CrashIfInvalid() const {
+#ifdef TEMP_INSTRUMENTATION_467797
+  Liveness liveness = liveness_;
+
+  if (liveness == ALIVE)
+    return;
+
+  // Copy relevant variables onto the stack to guarantee they will be available
+  // in minidumps, and then crash.
+  base::debug::StackTrace stack_trace = stack_trace_;
+
+  base::debug::Alias(&liveness);
+  base::debug::Alias(&stack_trace);
+
+  CHECK_EQ(ALIVE, liveness);
+#endif
+}
+
 }  // namespace net

net/base/net_log.h

@@ -7,10 +7,22 @@
 
 #include <string>
 
+#include "build/build_config.h"
+
+// TODO(eroman): Temporary while investigating crbug.com/467797.
+//               Note base::Debug::StackTrace() is not supported in NACL builds
+//               so conditionally disabled it there.
+#ifndef OS_NACL
+#define TEMP_INSTRUMENTATION_467797
+#endif
+
 #include "base/atomicops.h"
 #include "base/basictypes.h"
 #include "base/callback_forward.h"
 #include "base/compiler_specific.h"
+#ifdef TEMP_INSTRUMENTATION_467797
+#include "base/debug/stack_trace.h"
+#endif
 #include "base/observer_list.h"
 #include "base/strings/string16.h"
 #include "base/synchronization/lock.h"
@@ -332,6 +344,7 @@ class NET_EXPORT NetLog {
 class NET_EXPORT BoundNetLog {
  public:
   BoundNetLog() : net_log_(NULL) {}
+  ~BoundNetLog();
 
   // Add a log entry to the NetLog for the bound source.
   void AddEntry(NetLog::EventType type, NetLog::EventPhase phase) const;
@@ -388,12 +401,29 @@ class NET_EXPORT BoundNetLog {
   NetLog* net_log() const { return net_log_; }
 
  private:
+#ifdef TEMP_INSTRUMENTATION_467797
+  // TODO(eroman): Temporary while investigating crbug.com/467797
+  enum Liveness {
+    ALIVE = 0xCA11AB13,
+    DEAD = 0xDEADBEEF,
+  };
+#endif
+
   BoundNetLog(const NetLog::Source& source, NetLog* net_log)
       : source_(source), net_log_(net_log) {
   }
 
+  // TODO(eroman): Temporary while investigating crbug.com/467797
+  void CrashIfInvalid() const;
+
   NetLog::Source source_;
   NetLog* net_log_;
+
+#ifdef TEMP_INSTRUMENTATION_467797
+  // TODO(eroman): Temporary while investigating crbug.com/467797
+  Liveness liveness_ = ALIVE;
+  base::debug::StackTrace stack_trace_;
+#endif
 };
 
 }  // namespace net