Stop attempting to write to transport sockets in NSS on failure.

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 2122 matching lines @@
 
 // Return 0 if nss_bufs_ was empty,
 // > 0 for bytes transferred immediately,
 // < 0 for error (or the non-error ERR_IO_PENDING).
 int SSLClientSocketNSS::Core::BufferSend() {
   DCHECK(OnNSSTaskRunner());
 
   if (transport_send_busy_)
     return ERR_IO_PENDING;
 
+  // If there was an error, return it synchronously rather than call

[wtc, 2014/06/17 18:24:06]

Nit: "return it" is no longer accurate because you are now returning
ERR_ABORTED. The CL's description says "On failure, future transport writes
should synchronously return the error" and would also need to be updated.

Rather than updating the comment, you can also just return the last write error
here.

[davidben, 2014/06/17 20:27:43]

Done.

+  // DoBufferSend on the network task runner. This is important to prevent
+  // spinning infinitely in the off-thread NSS case. The error code itself is
+  // ignored, so just return ERR_ABORTED. See https://crbug.com/381160.
+  if (memio_LastWriteError(nss_bufs_) != 0)
+    return ERR_ABORTED;
+
   const char* buf1;
   const char* buf2;
   unsigned int len1, len2;
   memio_GetWriteParams(nss_bufs_, &buf1, &len1, &buf2, &len2);

[wtc, 2014/06/17 18:24:06]

Another option is to make memio_GetWriteParams return the last write error.
There are only two calls to memio_GetWriteParams (the other call is in
ssl_server_socket_nss.cc), so this would be a simple change as well.

[Ryan Sleevi, 2014/06/17 19:43:39]

+1

[davidben, 2014/06/17 20:27:43]

Done.

   const unsigned int len = len1 + len2;
 
   int rv = 0;
   if (len) {
     scoped_refptr<IOBuffer> send_buffer(new IOBuffer(len));
     memcpy(send_buffer->data(), buf1, len1);
     memcpy(send_buffer->data() + len1, buf2, len2);
 
     if (OnNetworkTaskRunner()) {
       rv = DoBufferSend(send_buffer.get(), len);
@@ skipping 1457 matching lines @@
 scoped_refptr<X509Certificate>
 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const {
   return core_->state().server_cert.get();
 }
 
 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const {
   return server_bound_cert_service_;
 }
 
 }  // namespace net