Fix crash bug in SpdyProxyClientSocket.GetPeerAddress where

net/spdy/spdy_proxy_client_socket.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_proxy_client_socket.h"
 
 #include <algorithm>  // min
 
 #include "base/logging.h"
 #include "base/string_util.h"
@@ skipping 26 matching lines @@
       write_callback_(NULL),
       endpoint_(endpoint),
       auth_(
           new HttpAuthController(HttpAuth::AUTH_PROXY,
                                  GURL("https://" + proxy_server.ToString()),
                                  auth_cache,
                                  auth_handler_factory)),
       user_buffer_(NULL),
       write_buffer_len_(0),
       write_bytes_outstanding_(0),
-      eof_has_been_read_(false),
       ALLOW_THIS_IN_INITIALIZER_LIST(weak_factory_(this)),
       net_log_(spdy_stream->net_log()) {
   request_.method = "CONNECT";
   request_.url = url;
   if (!user_agent.empty())
     request_.extra_headers.SetHeader(HttpRequestHeaders::kUserAgent,
                                      user_agent);
   spdy_stream_->SetDelegate(this);
   was_ever_used_ = spdy_stream_->WasEverUsed();
 }
@@ skipping 59 matching lines @@
 
   next_state_ = STATE_DISCONNECTED;
 
   if (spdy_stream_)
     // This will cause OnClose to be invoked, which takes care of
     // cleaning up all the internal state.
     spdy_stream_->Cancel();
 }
 
 bool SpdyProxyClientSocket::IsConnected() const {
-  return next_state_ == STATE_OPEN || next_state_ == STATE_CLOSED;
+  return next_state_ == STATE_OPEN;
 }
 
 bool SpdyProxyClientSocket::IsConnectedAndIdle() const {
-  return IsConnected() && spdy_stream_.get() != NULL &&
-      !spdy_stream_->is_idle();
+  return IsConnected() && read_buffer_.empty() && spdy_stream_->is_idle();
 }
 
 const BoundNetLog& SpdyProxyClientSocket::NetLog() const {
   return net_log_;
 }
 
 void SpdyProxyClientSocket::SetSubresourceSpeculation() {
   // TODO(rch): what should this implementation be?
 }
 
@@ skipping 18 matching lines @@
 }
 
 int SpdyProxyClientSocket::Read(IOBuffer* buf, int buf_len,
                                 OldCompletionCallback* callback) {
   DCHECK(!read_callback_);
   DCHECK(!user_buffer_);
 
   if (next_state_ == STATE_DISCONNECTED)
     return ERR_SOCKET_NOT_CONNECTED;
 
-  if (!spdy_stream_ && read_buffer_.empty()) {
-    if (eof_has_been_read_)
-      return ERR_CONNECTION_CLOSED;
-    eof_has_been_read_ = true;
+  if (next_state_ == STATE_CLOSED && read_buffer_.empty()) {
+    Disconnect();

[wtc, 2011/12/02 23:16:40]

This Disconnect() call may not be necessary.

I understand you added the Disconnect() call to replace
the eof_has_been_read_ member, because you want Read()
to return 0 only once.

It is also reasonable for Read() to return 0 repeatedly
once the peer closed the connection.  I don't remember
how a TCP socket handles this case.  It would be a good
idea to do an experiment to find how how a TCP socket
behaves and match its behavior, but it may not be worth
the effort.

[Ryan Hamilton, 2011/12/02 23:59:17]

You're right.  recv will return 0 each time you call it on a closed socket. 
I've removed the call to Disconnect().

     return 0;
   }
 
   DCHECK(next_state_ == STATE_OPEN || next_state_ == STATE_CLOSED);
   DCHECK(buf);
   user_buffer_ = new DrainableIOBuffer(buf, buf_len);
   int result = PopulateUserReadBuffer();
   if (result == 0) {
     DCHECK(callback);
     read_callback_ = callback;
@@ skipping 20 matching lines @@
       data->DidConsume(bytes_to_copy);
     }
   }
 
   return user_buffer_->BytesConsumed();
 }
 
 int SpdyProxyClientSocket::Write(IOBuffer* buf, int buf_len,
                                  OldCompletionCallback* callback) {
   DCHECK(!write_callback_);
-  if (next_state_ == STATE_DISCONNECTED)
+  if (next_state_ != STATE_OPEN)
     return ERR_SOCKET_NOT_CONNECTED;
 
-  if (!spdy_stream_)
-    return ERR_CONNECTION_CLOSED;
-
+  DCHECK(spdy_stream_);
   write_bytes_outstanding_= buf_len;
   if (buf_len <= kMaxSpdyFrameChunkSize) {
     int rv = spdy_stream_->WriteStreamData(buf, buf_len, spdy::DATA_FLAG_NONE);
     if (rv == ERR_IO_PENDING) {
       write_callback_ = callback;
       write_buffer_len_ = buf_len;
     }
     return rv;
   }
 
@@ skipping 305 matching lines @@
   }
   // This may have been deleted by read_callback_, so check first.
   if (weak_ptr && write_callback)
     write_callback->Run(ERR_CONNECTION_CLOSED);
 }
 
 void SpdyProxyClientSocket::set_chunk_callback(ChunkCallback* /*callback*/) {
 }
 
 }  // namespace net