Fix crash in ClientSocketPoolBase.

net/socket/tcp_client_socket_pool.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/tcp_client_socket_pool.h"
 
 #include "base/compiler_specific.h"
 #include "base/field_trial.h"
 #include "base/message_loop.h"
 #include "base/time.h"
@@ skipping 215 matching lines @@
       return;
     }
   }
 
   // It's invalid to cancel a non-existent request.
   CHECK(ContainsKey(group.connecting_requests, handle));
 
   RequestMap::iterator map_it = group.connecting_requests.find(handle);
   if (map_it != group.connecting_requests.end()) {
     RemoveConnectingSocket(handle);
-
     group.connecting_requests.erase(map_it);
-    group.active_socket_count--;
-
-    if (!group.pending_requests.empty()) {
-      ProcessPendingRequest(group_name, &group);
-      return;  // |group| may be invalid after this, so return to be safe.
-    }
-
-    // Delete group if no longer needed.
-    if (group.active_socket_count == 0 && group.idle_sockets.empty()) {
-      CHECK(group.pending_requests.empty());
-      CHECK(group.connecting_requests.empty());
-      group_map_.erase(group_name);
-      return;  // |group| is invalid after this, so return to be safe.
-    }
+    RemoveActiveSocket(group_name, &group);
   }
-
-  CheckSocketCounts(group);
 }
 
 void ClientSocketPoolBase::ReleaseSocket(const std::string& group_name,
                                          ClientSocket* socket) {
   // Run this asynchronously to allow the caller to finish before we let
   // another to begin doing work.  This also avoids nasty recursion issues.
   // NOTE: We cannot refer to the handle argument after this method returns.
   MessageLoop::current()->PostTask(FROM_HERE, NewRunnableMethod(
       this, &ClientSocketPoolBase::DoReleaseSocket, group_name, socket));
 }
@@ skipping 101 matching lines @@
 void ClientSocketPoolBase::DoReleaseSocket(const std::string& group_name,
                                            ClientSocket* socket) {
   GroupMap::iterator i = group_map_.find(group_name);
   CHECK(i != group_map_.end());
 
   Group& group = i->second;
 
   CHECK(group.active_socket_count > 0);
   CheckSocketCounts(group);
 
-  group.active_socket_count--;
   group.sockets_handed_out_count--;
 
   const bool can_reuse = socket->IsConnectedAndIdle();
   if (can_reuse) {
     IdleSocket idle_socket;
     idle_socket.socket = socket;
     idle_socket.start_time = base::TimeTicks::Now();
 
     group.idle_sockets.push_back(idle_socket);
     IncrementIdleCount();
   } else {
     delete socket;
   }
 
-  // Process one pending request.
-  if (!group.pending_requests.empty()) {
-    ProcessPendingRequest(group_name, &group);
-    return;
-  }
-
-  // Delete group if no longer needed.
-  if (group.active_socket_count == 0 && group.idle_sockets.empty()) {
-    CHECK(group.pending_requests.empty());
-    CHECK(group.connecting_requests.empty());
-    group_map_.erase(i);
-  } else {
-    CheckSocketCounts(group);
-  }
+  RemoveActiveSocket(group_name, &group);
 }
 
 ClientSocketPoolBase::Request* ClientSocketPoolBase::GetConnectingRequest(
     const std::string& group_name, const ClientSocketHandle* handle) {
   GroupMap::iterator group_it = group_map_.find(group_name);
   if (group_it == group_map_.end())
     return NULL;
 
   Group& group = group_it->second;
 
@@ skipping 19 matching lines @@
 
   RequestMap* request_map = &group.connecting_requests;
 
   RequestMap::iterator it = request_map->find(handle);
   CHECK(it != request_map->end());
   Request request = it->second;
   request_map->erase(it);
   DCHECK_EQ(request.handle, handle);
 
   if (deactivate) {
-    group.active_socket_count--;
-
-    // Delete group if no longer needed.
-    if (group.active_socket_count == 0 && group.idle_sockets.empty()) {
-      DCHECK(group.pending_requests.empty());
-      DCHECK(group.connecting_requests.empty());
-      group_map_.erase(group_name);
-    } else {
-      CheckSocketCounts(group);
-    }
+    RemoveActiveSocket(group_name, &group);
   } else {
     request.handle->set_socket(socket);
     request.handle->set_is_reused(false);
     group.sockets_handed_out_count++;
 
     CheckSocketCounts(group);
   }
 
   RemoveConnectingSocket(request.handle);
 
@@ skipping 11 matching lines @@
 }
 
 void ClientSocketPoolBase::RemoveConnectingSocket(
     const ClientSocketHandle* handle) {
   ConnectingSocketMap::iterator it = connecting_socket_map_.find(handle);
   CHECK(it != connecting_socket_map_.end());
   delete it->second;
   connecting_socket_map_.erase(it);
 }
 
+void ClientSocketPoolBase::RemoveActiveSocket(const std::string& group_name,
+                                              Group* group) {
+  group->active_socket_count--;
+
+  if (!group->pending_requests.empty()) {
+    ProcessPendingRequest(group_name, group);
+    // |group| may no longer be valid after this point.  Be careful not to
+    // access it again.
+  } else if (group->active_socket_count == 0 && group->idle_sockets.empty()) {
+    // Delete |group| if no longer needed.  |group| will no longer be valid.
+    DCHECK(group->connecting_requests.empty());
+    group_map_.erase(group_name);
+  } else {
+    CheckSocketCounts(*group);
+  }
+}
+
 void ClientSocketPoolBase::ProcessPendingRequest(const std::string& group_name,
                                                  Group* group) {
   Request r = group->pending_requests.front();
   group->pending_requests.pop_front();
 
   int rv = RequestSocket(
       group_name, r.resolve_info, r.priority, r.handle, r.callback);
 
   // |group| may be invalid after RequestSocket.
 
@@ skipping 51 matching lines @@
     const std::string& group_name) const {
   return base_->IdleSocketCountInGroup(group_name);
 }
 
 LoadState TCPClientSocketPool::GetLoadState(
     const std::string& group_name, const ClientSocketHandle* handle) const {
   return base_->GetLoadState(group_name, handle);
 }
 
 }  // namespace net