Fix a use-after free in socket pool which can happen after reaching the maxium number of sockets.

net/socket/client_socket_pool_base.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/client_socket_pool_base.h"
 
 #include <math.h>
 #include "base/compiler_specific.h"
 #include "base/debug/alias.h"
 #include "base/format_macros.h"
@@ skipping 368 matching lines @@
       do {
         if (!CloseOneIdleConnectionInLayeredPool()) {
           // We could check if we really have a stalled group here, but it
           // requires a scan of all groups, so just flip a flag here, and do
           // the check later.
           request->net_log().AddEvent(
               NetLog::TYPE_SOCKET_POOL_STALLED_MAX_SOCKETS, NULL);
           return ERR_IO_PENDING;
         }
       } while (ReachedMaxSocketsLimit());
+
+      // It is possible that CloseOneIdleConnectionInLayeredPool() has deleted
+      // our Group (see http://crbug.com/109876), so look it up again
+      // to be safe.
+      group = GetOrCreateGroup(group_name);
     }
   }
 
   // We couldn't find a socket to reuse, and there's space to allocate one,
   // so allocate and connect a new one.
   scoped_ptr<ConnectJob> connect_job(
       connect_job_factory_->NewConnectJob(group_name, *request, this));
 
   connect_job->Initialize(preconnecting);
   int rv = connect_job->Connect();
@@ skipping 857 matching lines @@
 }
 
 }  // namespace internal
 
 }  // namespace net
 
 // Restore default optimization settings.
 #if defined(COMPILER_MSVC)
 #pragma optimize("", on)
 #endif