This CL changes the lifespan of SSLConnectJobMessengers so that they are created only when needed,

net/socket/ssl_client_socket_pool.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_pool.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram.h"
@@ skipping 86 matching lines @@
 
 SSLConnectJobMessenger::SocketAndCallback::SocketAndCallback(
     SSLClientSocket* ssl_socket,
     const base::Closure& job_resumption_callback)
     : socket(ssl_socket), callback(job_resumption_callback) {
 }
 
 SSLConnectJobMessenger::SocketAndCallback::~SocketAndCallback() {
 }
 
-SSLConnectJobMessenger::SSLConnectJobMessenger() : weak_factory_(this) {
+SSLConnectJobMessenger::SSLConnectJobMessenger(
+    const ConnectionCompleteCallback& connection_complete_callback)
+    : weak_factory_(this),
+      connection_complete_callback_(connection_complete_callback) {
 }
 
 SSLConnectJobMessenger::~SSLConnectJobMessenger() {
 }
 
 void SSLConnectJobMessenger::RemovePendingSocket(SSLClientSocket* ssl_socket) {
   // Sockets do not need to be removed from connecting_sockets_ because
   // OnSSLHandshakeCompleted will do this.
   for (SSLPendingSocketsAndCallbacks::iterator it =
            pending_sockets_and_callbacks_.begin();
        it != pending_sockets_and_callbacks_.end();
        ++it) {
     if (it->socket == ssl_socket) {
       pending_sockets_and_callbacks_.erase(it);
       return;
     }
   }
 }
 
 bool SSLConnectJobMessenger::CanProceed(SSLClientSocket* ssl_socket) {
-  // If the session is in the session cache, or there are no connecting
-  // sockets, allow the connection to proceed.
-  return ssl_socket->InSessionCache() || connecting_sockets_.empty();
+  // If there are no connecting sockets allow the connection to proceed.
+  return connecting_sockets_.empty();
 }
 
 void SSLConnectJobMessenger::MonitorConnectionResult(
     SSLClientSocket* ssl_socket) {
   connecting_sockets_.push_back(ssl_socket);
   ssl_socket->SetHandshakeCompletionCallback(
       base::Bind(&SSLConnectJobMessenger::OnSSLHandshakeCompleted,
                  weak_factory_.GetWeakPtr()));
 }
 
 void SSLConnectJobMessenger::AddPendingSocket(SSLClientSocket* ssl_socket,
                                               const base::Closure& callback) {
   DCHECK(!connecting_sockets_.empty());
   pending_sockets_and_callbacks_.push_back(
       SocketAndCallback(ssl_socket, callback));
 }
 
 void SSLConnectJobMessenger::OnSSLHandshakeCompleted() {
+  SSLClientSocket* ssl_socket = NULL;
+  if (!connecting_sockets_.empty())
+    ssl_socket = connecting_sockets_.front();

[Ryan Sleevi, 2014/08/13 01:02:15]

Are these changes unrelated? Under what scenario can this happen? It may be
worth adding a comment to a doc to explain this condition.

[mshelley, 2014/08/13 08:09:59]

Done.

   connecting_sockets_.clear();
   SSLPendingSocketsAndCallbacks temp_list;
   temp_list.swap(pending_sockets_and_callbacks_);
   RunAllCallbacks(temp_list);
+  if (ssl_socket)
+    connection_complete_callback_.Run(ssl_socket->GetSessionCacheKey());
 }
 
 void SSLConnectJobMessenger::RunAllCallbacks(
     const SSLPendingSocketsAndCallbacks& pending_sockets_and_callbacks) {
   for (std::vector<SocketAndCallback>::const_iterator it =
            pending_sockets_and_callbacks.begin();
        it != pending_sockets_and_callbacks.end();
        ++it) {
     it->callback.Run();
   }
 }
 
 // Timeout for the SSL handshake portion of the connect.
 static const int kSSLHandshakeTimeoutInSeconds = 30;
 
-SSLConnectJob::SSLConnectJob(const std::string& group_name,
-                             RequestPriority priority,
-                             const scoped_refptr<SSLSocketParams>& params,
-                             const base::TimeDelta& timeout_duration,
-                             TransportClientSocketPool* transport_pool,
-                             SOCKSClientSocketPool* socks_pool,
-                             HttpProxyClientSocketPool* http_proxy_pool,
-                             ClientSocketFactory* client_socket_factory,
-                             HostResolver* host_resolver,
-                             const SSLClientSocketContext& context,
-                             SSLConnectJobMessenger* messenger,
-                             Delegate* delegate,
-                             NetLog* net_log)
+SSLConnectJob::SSLConnectJob(
+    const std::string& group_name,
+    RequestPriority priority,
+    const scoped_refptr<SSLSocketParams>& params,
+    const base::TimeDelta& timeout_duration,
+    TransportClientSocketPool* transport_pool,
+    SOCKSClientSocketPool* socks_pool,
+    HttpProxyClientSocketPool* http_proxy_pool,
+    ClientSocketFactory* client_socket_factory,
+    HostResolver* host_resolver,
+    const SSLClientSocketContext& context,
+    GetMessengerForUncachedSessionCallback uncached_session_callback,
+    bool enable_ssl_connect_job_waiting,
+    Delegate* delegate,
+    NetLog* net_log)
     : ConnectJob(group_name,
                  timeout_duration,
                  priority,
                  delegate,
                  BoundNetLog::Make(net_log, NetLog::SOURCE_CONNECT_JOB)),
       params_(params),
       transport_pool_(transport_pool),
       socks_pool_(socks_pool),
       http_proxy_pool_(http_proxy_pool),
       client_socket_factory_(client_socket_factory),
       host_resolver_(host_resolver),
       context_(context.cert_verifier,
                context.channel_id_service,
                context.transport_security_state,
                context.cert_transparency_verifier,
                (params->privacy_mode() == PRIVACY_MODE_ENABLED
                     ? "pm/" + context.ssl_session_cache_shard
                     : context.ssl_session_cache_shard)),
       io_callback_(
           base::Bind(&SSLConnectJob::OnIOComplete, base::Unretained(this))),
-      messenger_(messenger),
-      weak_factory_(this) {
+      messenger_(NULL),
+      weak_factory_(this),

[Ryan Sleevi, 2014/08/13 01:02:12]

see comment about Weak Factory's always needing to be last.

[mshelley, 2014/08/13 08:09:59]

Done.

+      uncached_session_callback_(uncached_session_callback),
+      enable_ssl_connect_job_waiting_(enable_ssl_connect_job_waiting) {
 }
 
 SSLConnectJob::~SSLConnectJob() {
   if (ssl_socket_.get() && messenger_)
     messenger_->RemovePendingSocket(ssl_socket_.get());
 }
 
 LoadState SSLConnectJob::GetLoadState() const {
   switch (next_state_) {
     case STATE_TUNNEL_CONNECT_COMPLETE:
@@ skipping 182 matching lines @@
     connect_timing_.connect_start = socket_connect_timing.connect_start;
     connect_timing_.dns_start = socket_connect_timing.dns_start;
     connect_timing_.dns_end = socket_connect_timing.dns_end;
   }
 
   ssl_socket_ = client_socket_factory_->CreateSSLClientSocket(
       transport_socket_handle_.Pass(),
       params_->host_and_port(),
       params_->ssl_config(),
       context_);
+
+  if (!ssl_socket_->InSessionCache() && enable_ssl_connect_job_waiting_)
+    RunGetMessengerForUncachedSessionCallback(

[Ryan Sleevi, 2014/08/13 01:02:11]

This is only called in one place (here). I'd just inline the callback call.

[mshelley, 2014/08/13 08:09:59]

Done.

+        ssl_socket_->GetSessionCacheKey());
+
   return OK;
 }
 
 int SSLConnectJob::DoCheckForResume() {
   next_state_ = STATE_SSL_CONNECT;
-  if (!messenger_)
+
+  if (ssl_socket_->InSessionCache() || !messenger_)
     return OK;
 
-  // TODO(mshelley): Remove duplicate InSessionCache() calls.
   if (messenger_->CanProceed(ssl_socket_.get())) {
-    if (!ssl_socket_->InSessionCache())
-      messenger_->MonitorConnectionResult(ssl_socket_.get());
+    messenger_->MonitorConnectionResult(ssl_socket_.get());
+    // The SSLConnectJob no longer needs access to the messenger after this
+    // point.
+    messenger_ = NULL;
     return OK;
   }
+
   messenger_->AddPendingSocket(ssl_socket_.get(),
                                base::Bind(&SSLConnectJob::ResumeSSLConnection,
                                           weak_factory_.GetWeakPtr()));
+
   return ERR_IO_PENDING;
 }
 
 int SSLConnectJob::DoSSLConnect() {
   next_state_ = STATE_SSL_CONNECT_COMPLETE;
 
   connect_timing_.ssl_start = base::TimeTicks::Now();
 
   return ssl_socket_->Connect(io_callback_);
 }
@@ skipping 117 matching lines @@
     error_response_info_.cert_request_info = new SSLCertRequestInfo;
     ssl_socket_->GetSSLCertRequestInfo(
         error_response_info_.cert_request_info.get());
   }
 
   return result;
 }
 
 void SSLConnectJob::ResumeSSLConnection() {
   DCHECK_EQ(next_state_, STATE_SSL_CONNECT);
+  messenger_ = NULL;
   OnIOComplete(OK);
 }
 
+void SSLConnectJob::RunGetMessengerForUncachedSessionCallback(
+    const std::string& cache_key) {
+  messenger_ = uncached_session_callback_.Run(cache_key);
+}
+
 SSLConnectJob::State SSLConnectJob::GetInitialState(
     SSLSocketParams::ConnectionType connection_type) {
   switch (connection_type) {
     case SSLSocketParams::DIRECT:
       return STATE_TRANSPORT_CONNECT;
     case SSLSocketParams::HTTP_PROXY:
       return STATE_TUNNEL_CONNECT;
     case SSLSocketParams::SOCKS_PROXY:
       return STATE_SOCKS_CONNECT;
   }
   NOTREACHED();
   return STATE_NONE;
 }
 
 int SSLConnectJob::ConnectInternal() {
   next_state_ = GetInitialState(params_->GetConnectionType());
   return DoLoop(OK);
 }
 
 SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
     TransportClientSocketPool* transport_pool,
     SOCKSClientSocketPool* socks_pool,
     HttpProxyClientSocketPool* http_proxy_pool,
     ClientSocketFactory* client_socket_factory,
     HostResolver* host_resolver,
     const SSLClientSocketContext& context,
     bool enable_ssl_connect_job_waiting,
+    SSLConnectJob::GetMessengerForUncachedSessionCallback
+        uncached_session_callback,
     NetLog* net_log)
     : transport_pool_(transport_pool),
       socks_pool_(socks_pool),
       http_proxy_pool_(http_proxy_pool),
       client_socket_factory_(client_socket_factory),
       host_resolver_(host_resolver),
       context_(context),
       enable_ssl_connect_job_waiting_(enable_ssl_connect_job_waiting),
-      net_log_(net_log),
-      messenger_map_(new MessengerMap) {
+      uncached_session_callback_(uncached_session_callback),
+      net_log_(net_log) {
   base::TimeDelta max_transport_timeout = base::TimeDelta();
   base::TimeDelta pool_timeout;
   if (transport_pool_)
     max_transport_timeout = transport_pool_->ConnectionTimeout();
   if (socks_pool_) {
     pool_timeout = socks_pool_->ConnectionTimeout();
     if (pool_timeout > max_transport_timeout)
       max_transport_timeout = pool_timeout;
   }
   if (http_proxy_pool_) {
     pool_timeout = http_proxy_pool_->ConnectionTimeout();
     if (pool_timeout > max_transport_timeout)
       max_transport_timeout = pool_timeout;
   }
   timeout_ = max_transport_timeout +
       base::TimeDelta::FromSeconds(kSSLHandshakeTimeoutInSeconds);
 }
 
 SSLClientSocketPool::SSLConnectJobFactory::~SSLConnectJobFactory() {
-  STLDeleteValues(messenger_map_.get());
 }
 
 SSLClientSocketPool::SSLClientSocketPool(
     int max_sockets,
     int max_sockets_per_group,
     ClientSocketPoolHistograms* histograms,
     HostResolver* host_resolver,
     CertVerifier* cert_verifier,
     ChannelIDService* channel_id_service,
     TransportSecurityState* transport_security_state,
@@ skipping 20 matching lines @@
                 socks_pool,
                 http_proxy_pool,
                 client_socket_factory,
                 host_resolver,
                 SSLClientSocketContext(cert_verifier,
                                        channel_id_service,
                                        transport_security_state,
                                        cert_transparency_verifier,
                                        ssl_session_cache_shard),
                 enable_ssl_connect_job_waiting,
+                base::Bind(&SSLClientSocketPool::AddSSLConnectJobMessenger,
+                           base::Unretained(this)),
                 net_log)),
       ssl_config_service_(ssl_config_service) {
   if (ssl_config_service_.get())
     ssl_config_service_->AddObserver(this);
   if (transport_pool_)
     base_.AddLowerLayeredPool(transport_pool_);
   if (socks_pool_)
     base_.AddLowerLayeredPool(socks_pool_);
   if (http_proxy_pool_)
     base_.AddLowerLayeredPool(http_proxy_pool_);
 }
 
 SSLClientSocketPool::~SSLClientSocketPool() {
+  for (MessengerMap::iterator it = messenger_map_.begin();
+       it != messenger_map_.end();
+       ++it) {
+    delete it->second;
+  }
   if (ssl_config_service_.get())
     ssl_config_service_->RemoveObserver(this);
 }
 
-scoped_ptr<ConnectJob>
-SSLClientSocketPool::SSLConnectJobFactory::NewConnectJob(
+scoped_ptr<ConnectJob> SSLClientSocketPool::SSLConnectJobFactory::NewConnectJob(
     const std::string& group_name,
     const PoolBase::Request& request,
     ConnectJob::Delegate* delegate) const {
-  SSLConnectJobMessenger* messenger = NULL;
-  if (enable_ssl_connect_job_waiting_) {
-    std::string cache_key = SSLClientSocket::CreateSessionCacheKey(
-        request.params()->host_and_port(), context_.ssl_session_cache_shard);
-    MessengerMap::const_iterator it = messenger_map_->find(cache_key);
-    if (it == messenger_map_->end()) {
-      std::pair<MessengerMap::iterator, bool> iter = messenger_map_->insert(
-          MessengerMap::value_type(cache_key, new SSLConnectJobMessenger()));
-      it = iter.first;
-    }
-    messenger = it->second;
-  }
-
-  return scoped_ptr<ConnectJob>(new SSLConnectJob(group_name,
-                                                  request.priority(),
-                                                  request.params(),
-                                                  ConnectionTimeout(),
-                                                  transport_pool_,
-                                                  socks_pool_,
-                                                  http_proxy_pool_,
-                                                  client_socket_factory_,
-                                                  host_resolver_,
-                                                  context_,
-                                                  messenger,
-                                                  delegate,
-                                                  net_log_));
+  return scoped_ptr<ConnectJob>(
+      new SSLConnectJob(group_name,
+                        request.priority(),
+                        request.params(),
+                        ConnectionTimeout(),
+                        transport_pool_,
+                        socks_pool_,
+                        http_proxy_pool_,
+                        client_socket_factory_,
+                        host_resolver_,
+                        context_,
+                        uncached_session_callback_,
+                        enable_ssl_connect_job_waiting_,
+                        delegate,
+                        net_log_));
 }
 
-base::TimeDelta
-SSLClientSocketPool::SSLConnectJobFactory::ConnectionTimeout() const {
+base::TimeDelta SSLClientSocketPool::SSLConnectJobFactory::ConnectionTimeout()
+    const {
   return timeout_;
 }
 
 int SSLClientSocketPool::RequestSocket(const std::string& group_name,
                                        const void* socket_params,
                                        RequestPriority priority,
                                        ClientSocketHandle* handle,
                                        const CompletionCallback& callback,
                                        const BoundNetLog& net_log) {
   const scoped_refptr<SSLSocketParams>* casted_socket_params =
@@ skipping 94 matching lines @@
     HigherLayeredPool* higher_pool) {
   base_.RemoveHigherLayeredPool(higher_pool);
 }
 
 bool SSLClientSocketPool::CloseOneIdleConnection() {
   if (base_.CloseOneIdleSocket())
     return true;
   return base_.CloseOneIdleConnectionInHigherLayeredPool();
 }
 
+SSLConnectJobMessenger* SSLClientSocketPool::AddSSLConnectJobMessenger(
+    const std::string& cache_key) {
+  MessengerMap::const_iterator it = messenger_map_.find(cache_key);
+  if (it == messenger_map_.end()) {
+    std::pair<MessengerMap::iterator, bool> iter =
+        messenger_map_.insert(MessengerMap::value_type(
+            cache_key,
+            new SSLConnectJobMessenger(
+                base::Bind(&SSLClientSocketPool::DeleteSSLConnectJobMessenger,
+                           base::Unretained(this)))));

[Ryan Sleevi, 2014/08/13 01:02:11]

To hide the need to *pass* the cache key to the SSLConnectJobMessenger

new
SSLConnectJobMessenger(base::Bind(&SSLClientSocketPool::DeleteSSLConnectJobMessenger,
base::Unretained(this), cache_key))

Then on line 159,
connection_complete_callback_.Run();

There's no need to look up the cache key from the SSL socket, and it helps split
up the coupling a bit (since it's the *Pool*, not the *Messenger*, that decides
how some of these bits are mapped. And, to a degree, the *socket* when
requesting from the *pool*. But not the *messenger*)

[mshelley, 2014/08/13 08:09:59]

Done.

+    it = iter.first;
+  }
+  return it->second;
+}
+
+void SSLClientSocketPool::DeleteSSLConnectJobMessenger(
+    const std::string& cache_key) {
+  MessengerMap::iterator it = messenger_map_.find(cache_key);
+  delete it->second;

[Ryan Sleevi, 2014/08/13 01:02:15]

CHECK_NE(it, messenger_map_.end()) ?

Otherwise, a possible double free here. Better to CHECK and force a quick crash
and a double-free security bug.

[mshelley, 2014/08/13 08:09:59]

Done.

+  messenger_map_.erase(it);
+}
+
 void SSLClientSocketPool::OnSSLConfigChanged() {
   FlushWithError(ERR_NETWORK_CHANGED);
 }
 
 }  // namespace net