Fix stack-use-after-free bugs in exo_unittests.

Bug: 855573
Change-Id: Ia62bf4d471589b6eb3916277746af4fd7e388ec1
Reviewed-on: https://chromium-review.googlesource.com/1111614Reviewed-by: David Reveman <reveman@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#569656}

components/exo/shell_surface_unittest.cc

@@ -458,14 +458,17 @@ uint32_t Configure(gfx::Size* suggested_size,
 }
 
 TEST_F(ShellSurfaceTest, ConfigureCallback) {
-  std::unique_ptr<Surface> surface(new Surface);
-  std::unique_ptr<ShellSurface> shell_surface(new ShellSurface(surface.get()));
-
+  // Must be before shell_surface so it outlives it, for shell_surface's
+  // destructor calls Configure() referencing these 4 variables.
   gfx::Size suggested_size;
   ash::mojom::WindowStateType has_state_type =
       ash::mojom::WindowStateType::NORMAL;
   bool is_resizing = false;
   bool is_active = false;
+
+  std::unique_ptr<Surface> surface(new Surface);
+  std::unique_ptr<ShellSurface> shell_surface(new ShellSurface(surface.get()));
+
   shell_surface->set_configure_callback(
       base::Bind(&Configure, base::Unretained(&suggested_size),
                  base::Unretained(&has_state_type),

components/exo/surface_unittest.cc

@@ -168,9 +168,12 @@ void SetFrameTime(base::TimeTicks* result, base::TimeTicks frame_time) {
 }
 
 TEST_P(SurfaceTest, RequestFrameCallback) {
+  // Must be before surface so it outlives it, for surface's destructor calls
+  // SetFrameTime() referencing this.
+  base::TimeTicks frame_time;
+
   std::unique_ptr<Surface> surface(new Surface);
 
-  base::TimeTicks frame_time;
   surface->RequestFrameCallback(
       base::Bind(&SetFrameTime, base::Unretained(&frame_time)));
   surface->Commit();