Fix a use-after free in socket pool which can happen after reaching the maxium number of sockets.

net/socket/client_socket_pool_base.cc

Index: net/socket/client_socket_pool_base.cc
diff --git a/net/socket/client_socket_pool_base.cc b/net/socket/client_socket_pool_base.cc
index 113985a4d4fc20d3484edb3462881f7d49c1e7be..6b2a75d64362766ee59502d1dd6f9e27699ca9df 100644
--- a/net/socket/client_socket_pool_base.cc
+++ b/net/socket/client_socket_pool_base.cc
@@ -386,6 +386,11 @@ int ClientSocketPoolBaseHelper::RequestSocketInternal(
           return ERR_IO_PENDING;
         }
       } while (ReachedMaxSocketsLimit());
+
+      // It is possible that CloseOneIdleConnectionInLayeredPool() has deleted
+      // our Group (see http://crbug.com/109876), so look it up again
+      // to be safe.
+      group = GetOrCreateGroup(group_name);
     }
   }