This CL changes the lifespan of SSLConnectJobMessengers so that they are created only when needed,

net/socket/ssl_client_socket_pool.cc

Index: net/socket/ssl_client_socket_pool.cc
diff --git a/net/socket/ssl_client_socket_pool.cc b/net/socket/ssl_client_socket_pool.cc
index e54f79c929cee2b2eacb398bfa8896bcc64b212b..31466fd8498e5c16727e1de2b639e1c1886f04c1 100644
--- a/net/socket/ssl_client_socket_pool.cc
+++ b/net/socket/ssl_client_socket_pool.cc
@@ -104,7 +104,10 @@ SSLConnectJobMessenger::SocketAndCallback::SocketAndCallback(
 SSLConnectJobMessenger::SocketAndCallback::~SocketAndCallback() {
 }
 
-SSLConnectJobMessenger::SSLConnectJobMessenger() : weak_factory_(this) {
+SSLConnectJobMessenger::SSLConnectJobMessenger(
+    const ConnectionCompleteCallback& connection_complete_callback)
+    : weak_factory_(this),
+      connection_complete_callback_(connection_complete_callback) {
 }
 
 SSLConnectJobMessenger::~SSLConnectJobMessenger() {
@@ -125,9 +128,8 @@ void SSLConnectJobMessenger::RemovePendingSocket(SSLClientSocket* ssl_socket) {
 }
 
 bool SSLConnectJobMessenger::CanProceed(SSLClientSocket* ssl_socket) {
-  // If the session is in the session cache, or there are no connecting
-  // sockets, allow the connection to proceed.
-  return ssl_socket->InSessionCache() || connecting_sockets_.empty();
+  // If there are no connecting sockets allow the connection to proceed.
+  return connecting_sockets_.empty();
 }
 
 void SSLConnectJobMessenger::MonitorConnectionResult(
@@ -146,10 +148,15 @@ void SSLConnectJobMessenger::AddPendingSocket(SSLClientSocket* ssl_socket,
 }
 
 void SSLConnectJobMessenger::OnSSLHandshakeCompleted() {
+  SSLClientSocket* ssl_socket = NULL;
+  if (!connecting_sockets_.empty())
+    ssl_socket = connecting_sockets_.front();

[Ryan Sleevi, 2014/08/13 01:02:15]

Are these changes unrelated? Under what scenario can this happen? It may be
worth adding a comment to a doc to explain this condition.

[mshelley, 2014/08/13 08:09:59]

Done.

   connecting_sockets_.clear();
   SSLPendingSocketsAndCallbacks temp_list;
   temp_list.swap(pending_sockets_and_callbacks_);
   RunAllCallbacks(temp_list);
+  if (ssl_socket)
+    connection_complete_callback_.Run(ssl_socket->GetSessionCacheKey());
 }
 
 void SSLConnectJobMessenger::RunAllCallbacks(
@@ -165,19 +172,21 @@ void SSLConnectJobMessenger::RunAllCallbacks(
 // Timeout for the SSL handshake portion of the connect.
 static const int kSSLHandshakeTimeoutInSeconds = 30;
 
-SSLConnectJob::SSLConnectJob(const std::string& group_name,
-                             RequestPriority priority,
-                             const scoped_refptr<SSLSocketParams>& params,
-                             const base::TimeDelta& timeout_duration,
-                             TransportClientSocketPool* transport_pool,
-                             SOCKSClientSocketPool* socks_pool,
-                             HttpProxyClientSocketPool* http_proxy_pool,
-                             ClientSocketFactory* client_socket_factory,
-                             HostResolver* host_resolver,
-                             const SSLClientSocketContext& context,
-                             SSLConnectJobMessenger* messenger,
-                             Delegate* delegate,
-                             NetLog* net_log)
+SSLConnectJob::SSLConnectJob(
+    const std::string& group_name,
+    RequestPriority priority,
+    const scoped_refptr<SSLSocketParams>& params,
+    const base::TimeDelta& timeout_duration,
+    TransportClientSocketPool* transport_pool,
+    SOCKSClientSocketPool* socks_pool,
+    HttpProxyClientSocketPool* http_proxy_pool,
+    ClientSocketFactory* client_socket_factory,
+    HostResolver* host_resolver,
+    const SSLClientSocketContext& context,
+    GetMessengerForUncachedSessionCallback uncached_session_callback,
+    bool enable_ssl_connect_job_waiting,
+    Delegate* delegate,
+    NetLog* net_log)
     : ConnectJob(group_name,
                  timeout_duration,
                  priority,
@@ -198,8 +207,10 @@ SSLConnectJob::SSLConnectJob(const std::string& group_name,
                     : context.ssl_session_cache_shard)),
       io_callback_(
           base::Bind(&SSLConnectJob::OnIOComplete, base::Unretained(this))),
-      messenger_(messenger),
-      weak_factory_(this) {
+      messenger_(NULL),
+      weak_factory_(this),

[Ryan Sleevi, 2014/08/13 01:02:12]

see comment about Weak Factory's always needing to be last.

[mshelley, 2014/08/13 08:09:59]

Done.

+      uncached_session_callback_(uncached_session_callback),
+      enable_ssl_connect_job_waiting_(enable_ssl_connect_job_waiting) {
 }
 
 SSLConnectJob::~SSLConnectJob() {
@@ -402,23 +413,32 @@ int SSLConnectJob::DoCreateSSLSocket() {
       params_->host_and_port(),
       params_->ssl_config(),
       context_);
+
+  if (!ssl_socket_->InSessionCache() && enable_ssl_connect_job_waiting_)
+    RunGetMessengerForUncachedSessionCallback(

[Ryan Sleevi, 2014/08/13 01:02:11]

This is only called in one place (here). I'd just inline the callback call.

[mshelley, 2014/08/13 08:09:59]

Done.

+        ssl_socket_->GetSessionCacheKey());
+
   return OK;
 }
 
 int SSLConnectJob::DoCheckForResume() {
   next_state_ = STATE_SSL_CONNECT;
-  if (!messenger_)
+
+  if (ssl_socket_->InSessionCache() || !messenger_)
     return OK;
 
-  // TODO(mshelley): Remove duplicate InSessionCache() calls.
   if (messenger_->CanProceed(ssl_socket_.get())) {
-    if (!ssl_socket_->InSessionCache())
-      messenger_->MonitorConnectionResult(ssl_socket_.get());
+    messenger_->MonitorConnectionResult(ssl_socket_.get());
+    // The SSLConnectJob no longer needs access to the messenger after this
+    // point.
+    messenger_ = NULL;
     return OK;
   }
+
   messenger_->AddPendingSocket(ssl_socket_.get(),
                                base::Bind(&SSLConnectJob::ResumeSSLConnection,
                                           weak_factory_.GetWeakPtr()));
+
   return ERR_IO_PENDING;
 }
 
@@ -556,9 +576,15 @@ int SSLConnectJob::DoSSLConnectComplete(int result) {
 
 void SSLConnectJob::ResumeSSLConnection() {
   DCHECK_EQ(next_state_, STATE_SSL_CONNECT);
+  messenger_ = NULL;
   OnIOComplete(OK);
 }
 
+void SSLConnectJob::RunGetMessengerForUncachedSessionCallback(
+    const std::string& cache_key) {
+  messenger_ = uncached_session_callback_.Run(cache_key);
+}
+
 SSLConnectJob::State SSLConnectJob::GetInitialState(
     SSLSocketParams::ConnectionType connection_type) {
   switch (connection_type) {
@@ -586,6 +612,8 @@ SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
     HostResolver* host_resolver,
     const SSLClientSocketContext& context,
     bool enable_ssl_connect_job_waiting,
+    SSLConnectJob::GetMessengerForUncachedSessionCallback
+        uncached_session_callback,
     NetLog* net_log)
     : transport_pool_(transport_pool),
       socks_pool_(socks_pool),
@@ -594,8 +622,8 @@ SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
       host_resolver_(host_resolver),
       context_(context),
       enable_ssl_connect_job_waiting_(enable_ssl_connect_job_waiting),
-      net_log_(net_log),
-      messenger_map_(new MessengerMap) {
+      uncached_session_callback_(uncached_session_callback),
+      net_log_(net_log) {
   base::TimeDelta max_transport_timeout = base::TimeDelta();
   base::TimeDelta pool_timeout;
   if (transport_pool_)
@@ -615,7 +643,6 @@ SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
 }
 
 SSLClientSocketPool::SSLConnectJobFactory::~SSLConnectJobFactory() {
-  STLDeleteValues(messenger_map_.get());
 }
 
 SSLClientSocketPool::SSLClientSocketPool(
@@ -656,6 +683,8 @@ SSLClientSocketPool::SSLClientSocketPool(
                                        cert_transparency_verifier,
                                        ssl_session_cache_shard),
                 enable_ssl_connect_job_waiting,
+                base::Bind(&SSLClientSocketPool::AddSSLConnectJobMessenger,
+                           base::Unretained(this)),
                 net_log)),
       ssl_config_service_(ssl_config_service) {
   if (ssl_config_service_.get())
@@ -669,45 +698,38 @@ SSLClientSocketPool::SSLClientSocketPool(
 }
 
 SSLClientSocketPool::~SSLClientSocketPool() {
+  for (MessengerMap::iterator it = messenger_map_.begin();
+       it != messenger_map_.end();
+       ++it) {
+    delete it->second;
+  }
   if (ssl_config_service_.get())
     ssl_config_service_->RemoveObserver(this);
 }
 
-scoped_ptr<ConnectJob>
-SSLClientSocketPool::SSLConnectJobFactory::NewConnectJob(
+scoped_ptr<ConnectJob> SSLClientSocketPool::SSLConnectJobFactory::NewConnectJob(
     const std::string& group_name,
     const PoolBase::Request& request,
     ConnectJob::Delegate* delegate) const {
-  SSLConnectJobMessenger* messenger = NULL;
-  if (enable_ssl_connect_job_waiting_) {
-    std::string cache_key = SSLClientSocket::CreateSessionCacheKey(
-        request.params()->host_and_port(), context_.ssl_session_cache_shard);
-    MessengerMap::const_iterator it = messenger_map_->find(cache_key);
-    if (it == messenger_map_->end()) {
-      std::pair<MessengerMap::iterator, bool> iter = messenger_map_->insert(
-          MessengerMap::value_type(cache_key, new SSLConnectJobMessenger()));
-      it = iter.first;
-    }
-    messenger = it->second;
-  }
-
-  return scoped_ptr<ConnectJob>(new SSLConnectJob(group_name,
-                                                  request.priority(),
-                                                  request.params(),
-                                                  ConnectionTimeout(),
-                                                  transport_pool_,
-                                                  socks_pool_,
-                                                  http_proxy_pool_,
-                                                  client_socket_factory_,
-                                                  host_resolver_,
-                                                  context_,
-                                                  messenger,
-                                                  delegate,
-                                                  net_log_));
-}
-
-base::TimeDelta
-SSLClientSocketPool::SSLConnectJobFactory::ConnectionTimeout() const {
+  return scoped_ptr<ConnectJob>(
+      new SSLConnectJob(group_name,
+                        request.priority(),
+                        request.params(),
+                        ConnectionTimeout(),
+                        transport_pool_,
+                        socks_pool_,
+                        http_proxy_pool_,
+                        client_socket_factory_,
+                        host_resolver_,
+                        context_,
+                        uncached_session_callback_,
+                        enable_ssl_connect_job_waiting_,
+                        delegate,
+                        net_log_));
+}
+
+base::TimeDelta SSLClientSocketPool::SSLConnectJobFactory::ConnectionTimeout()
+    const {
   return timeout_;
 }
 
@@ -822,6 +844,28 @@ bool SSLClientSocketPool::CloseOneIdleConnection() {
   return base_.CloseOneIdleConnectionInHigherLayeredPool();
 }
 
+SSLConnectJobMessenger* SSLClientSocketPool::AddSSLConnectJobMessenger(
+    const std::string& cache_key) {
+  MessengerMap::const_iterator it = messenger_map_.find(cache_key);
+  if (it == messenger_map_.end()) {
+    std::pair<MessengerMap::iterator, bool> iter =
+        messenger_map_.insert(MessengerMap::value_type(
+            cache_key,
+            new SSLConnectJobMessenger(
+                base::Bind(&SSLClientSocketPool::DeleteSSLConnectJobMessenger,
+                           base::Unretained(this)))));

[Ryan Sleevi, 2014/08/13 01:02:11]

To hide the need to *pass* the cache key to the SSLConnectJobMessenger

new
SSLConnectJobMessenger(base::Bind(&SSLClientSocketPool::DeleteSSLConnectJobMessenger,
base::Unretained(this), cache_key))

Then on line 159,
connection_complete_callback_.Run();

There's no need to look up the cache key from the SSL socket, and it helps split
up the coupling a bit (since it's the *Pool*, not the *Messenger*, that decides
how some of these bits are mapped. And, to a degree, the *socket* when
requesting from the *pool*. But not the *messenger*)

[mshelley, 2014/08/13 08:09:59]

Done.

+    it = iter.first;
+  }
+  return it->second;
+}
+
+void SSLClientSocketPool::DeleteSSLConnectJobMessenger(
+    const std::string& cache_key) {
+  MessengerMap::iterator it = messenger_map_.find(cache_key);
+  delete it->second;

[Ryan Sleevi, 2014/08/13 01:02:15]

CHECK_NE(it, messenger_map_.end()) ?

Otherwise, a possible double free here. Better to CHECK and force a quick crash
and a double-free security bug.

[mshelley, 2014/08/13 08:09:59]

Done.

+  messenger_map_.erase(it);
+}
+
 void SSLClientSocketPool::OnSSLConfigChanged() {
   FlushWithError(ERR_NETWORK_CHANGED);
 }