Fix crash in GetSpdySessionFromSSLSocket in the case where the...

net/spdy/spdy_session_pool.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_session_pool.h"
 
 #include "base/logging.h"
 #include "net/spdy/spdy_session.h"
 
 namespace net {
@@ skipping 33 matching lines @@
   DCHECK(list);
   if (!spdy_session)
     spdy_session = new SpdySession(host_port_pair, session, net_log.net_log());
 
   DCHECK(spdy_session);
   list->push_back(spdy_session);
   DCHECK_LE(list->size(), static_cast<unsigned int>(g_max_sessions_per_domain));
   return spdy_session;
 }
 
-scoped_refptr<SpdySession> SpdySessionPool::GetSpdySessionFromSSLSocket(
+net::Error SpdySessionPool::GetSpdySessionFromSSLSocket(
     const HostPortPair& host_port_pair,
     HttpNetworkSession* session,
     ClientSocketHandle* connection,
-    const BoundNetLog& net_log) {
+    const BoundNetLog& net_log,
+    scoped_refptr<SpdySession>& spdy_session) {
+  // Create the SPDY session and add it to the pool.
+  spdy_session = (new SpdySession(host_port_pair, session, net_log.net_log()));
   SpdySessionList* list = GetSessionList(host_port_pair);
   if (!list)
     list = AddSessionList(host_port_pair);
   DCHECK(list->empty());
-  scoped_refptr<SpdySession> spdy_session(
-      new SpdySession(host_port_pair, session, net_log.net_log()));
-  spdy_session->InitializeWithSSLSocket(connection);
   list->push_back(spdy_session);
-  return spdy_session;
+
+  // Now we can initialize the session with the SSL socket.
+  return spdy_session->InitializeWithSSLSocket(connection);
 }
 
 bool SpdySessionPool::HasSession(const HostPortPair& host_port_pair) const {
   if (GetSessionList(host_port_pair))
     return true;
   return false;
 }
 
 void SpdySessionPool::Remove(const scoped_refptr<SpdySession>& session) {
   SpdySessionList* list = GetSessionList(session->host_port_pair());
@@ skipping 48 matching lines @@
       scoped_refptr<SpdySession> session = list->front();
       list->pop_front();
       if (close)
         session->CloseAllStreams(net::ERR_ABORTED);
     }
     delete list;
   }
 }
 
 }  // namespace net