Fixes an invalid read bug in ClientSocketPoolBaseHelper and cancels ConnectJobs on network changes.

net/socket/client_socket_pool_base.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/client_socket_pool_base.h"
 
 #include "base/compiler_specific.h"
 #include "base/format_macros.h"
 #include "base/message_loop.h"
 #include "base/stats_counters.h"
@@ skipping 314 matching lines @@
   connecting_socket_count_++;
   group.jobs.insert(group.backup_job);
   ConnectJob* job = group.backup_job;
   group.backup_job = NULL;
   if (rv != ERR_IO_PENDING)
     OnConnectJobComplete(rv, job);
 }
 
 void ClientSocketPoolBaseHelper::CancelRequest(
     const std::string& group_name, const ClientSocketHandle* handle) {
+  // Running callbacks can cause the last outside reference to be released.
+  // Hold onto a reference.
+  scoped_refptr<ClientSocketPoolBaseHelper> ref_holder(this);
+
   CHECK(ContainsKey(group_map_, group_name));
 
   Group& group = group_map_[group_name];
 
   // Search pending_requests for matching handle.
   RequestQueue::iterator it = group.pending_requests.begin();
   for (; it != group.pending_requests.end(); ++it) {
     if ((*it)->handle() == handle) {
       const Request* req = RemoveRequestFromQueue(it, &group.pending_requests);
       req->net_log().AddEvent(NetLog::TYPE_CANCELLED, NULL);
@@ skipping 118 matching lines @@
                  &ClientSocketPoolBaseHelper::OnCleanupTimerFired);
 }
 
 void ClientSocketPoolBaseHelper::DecrementIdleCount() {
   if (--idle_socket_count_ == 0)
     timer_.Stop();
 }
 
 void ClientSocketPoolBaseHelper::DoReleaseSocket(const std::string& group_name,
                                                  ClientSocket* socket) {
+  // Running callbacks can cause the last outside reference to be released.
+  // Hold onto a reference.
+  scoped_refptr<ClientSocketPoolBaseHelper> ref_holder(this);
+
   GroupMap::iterator i = group_map_.find(group_name);
   CHECK(i != group_map_.end());
 
   Group& group = i->second;
 
   group.num_releasing_sockets--;
   DCHECK_GE(group.num_releasing_sockets, 0);
 
   CHECK_GT(handed_out_socket_count_, 0);
   handed_out_socket_count_--;
@@ skipping 73 matching lines @@
   }
   if (top_group) {
     *group = top_group;
     *group_name = *top_group_name;
   }
   return stalled_group_count;
 }
 
 void ClientSocketPoolBaseHelper::OnConnectJobComplete(
     int result, ConnectJob* job) {
+  // Running callbacks can cause the last outside reference to be released.
+  // Hold onto a reference.
+  scoped_refptr<ClientSocketPoolBaseHelper> ref_holder(this);
+
   DCHECK_NE(ERR_IO_PENDING, result);
   const std::string group_name = job->group_name();
   GroupMap::iterator group_it = group_map_.find(group_name);
   CHECK(group_it != group_map_.end());
   Group& group = group_it->second;
 
   // We've had a connect on the socket; discard any pending backup job
   // for this group and kill the pending task.
   group.CleanupBackupJob();
 
@@ skipping 28 matching lines @@
           NetLog::TYPE_SOCKET_POOL_CONNECT_JOB_ID,
           new NetLogIntegerParameter("source_id", job_log.source().id));
       r->net_log().EndEvent(NetLog::TYPE_SOCKET_POOL, NULL);
       r->callback()->Run(result);
     }
     MaybeOnAvailableSocketSlot(group_name);
   }
 }
 
 void ClientSocketPoolBaseHelper::OnIPAddressChanged() {
+  CancelAllConnectJobs();
   CloseIdleSockets();
 }
 
 void ClientSocketPoolBaseHelper::RemoveConnectJob(const ConnectJob *job,
                                                   Group* group) {
   CHECK_GT(connecting_socket_count_, 0);
   connecting_socket_count_--;
 
   DCHECK(job);
   delete job;
@@ skipping 118 matching lines @@
   DCHECK_LE(total, max_sockets_);
   if (total < max_sockets_)
     return false;
   LOG(WARNING) << "ReachedMaxSocketsLimit: " << total << "/" << max_sockets_;
   return true;
 }
 
 }  // namespace internal
 
 }  // namespace net