Add some CHECKs to track down the source of a NULL deref in the SSLClientSocketWin code.

net/http/http_network_transaction.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include "base/scoped_ptr.h"
 #include "base/compiler_specific.h"
 #include "base/field_trial.h"
 #include "base/string_util.h"
@@ skipping 336 matching lines @@
     // when establishing a tunnel because they might be controlled by an active
     // network attacker.  We don't worry about this for HTTP because an active
     // network attacker can already control HTTP sessions.
     // We reach this case when the user cancels a 407 proxy auth prompt.
     // See http://crbug.com/8473
     DCHECK(response_.headers->response_code() == 407);
     LogBlockedTunnelResponse(response_.headers->response_code());
     return ERR_TUNNEL_CONNECTION_FAILED;
   }
 
+  // http://crbug.com/16371: We're seeing |user_buf_->data()| return NULL.
+  // See if the user is passing in an IOBuffer with a NULL |data_|.
+  CHECK(buf);
+  CHECK(buf->data());
+
   read_buf_ = buf;
   read_buf_len_ = buf_len;
 
   next_state_ = STATE_READ_BODY;
   int rv = DoLoop(OK);
   if (rv == ERR_IO_PENDING)
     user_callback_ = callback;
   return rv;
 }
 
@@ skipping 438 matching lines @@
 
   // Grow the read buffer if necessary.
   if (header_buf_len_ == header_buf_capacity_) {
     header_buf_capacity_ += kHeaderBufInitialSize;
     header_buf_->Realloc(header_buf_capacity_);
   }
 
   int buf_len = header_buf_capacity_ - header_buf_len_;
   header_buf_->set_data(header_buf_len_);
 
+  // http://crbug.com/16371: We're seeing |user_buf_->data()| return NULL.
+  // See if the user is passing in an IOBuffer with a NULL |data_|.
+  CHECK(header_buf_->data());
+
   return http_stream_->Read(header_buf_, buf_len, &io_callback_);
 }
 
 int HttpNetworkTransaction::HandleConnectionClosedBeforeEndOfHeaders() {
   if (establishing_tunnel_) {
     // The connection was closed before the tunnel could be established.
     return ERR_TUNNEL_CONNECTION_FAILED;
   }
 
   if (has_found_status_line_start()) {
@@ skipping 944 matching lines @@
     host_and_port = proxy_info_.proxy_server().host_and_port();
   } else {
     DCHECK(target == HttpAuth::AUTH_SERVER);
     host_and_port = GetHostAndPort(request_->url);
   }
   auth_info->host_and_port = ASCIIToWide(host_and_port);
   response_.auth_challenge = auth_info;
 }
 
 }  // namespace net