This CL changes the lifespan of SSLConnectJobMessengers so that they are created only when needed,

net/socket/ssl_client_socket_pool.h

Index: net/socket/ssl_client_socket_pool.h
diff --git a/net/socket/ssl_client_socket_pool.h b/net/socket/ssl_client_socket_pool.h
index cfc7c0dfbabd3832d89d29ebc511b145d64226fd..b9457e9ea7be1f7029b34e84826803b1338fdf10 100644
--- a/net/socket/ssl_client_socket_pool.h
+++ b/net/socket/ssl_client_socket_pool.h
@@ -115,7 +115,9 @@ class SSLConnectJobMessenger {
 
   typedef std::vector<SocketAndCallback> SSLPendingSocketsAndCallbacks;
 
-  SSLConnectJobMessenger();
+  // |messenger_finished_callback| when a connection monitored by the
+  // SSLConnectJobMessenger has completed.

[wtc, 2014/08/15 21:49:12]

This comment is now an incomplete sentence. Also I think it must point out that
this callback is invoked when we no longer need the messenger. I suggest
something like:

// |messenger_finished_callback| is run when we are finished with the
SSLConnectJobMessenger.

or

// |messenger_finished_callback| is run when a connection monitored by the
SSLConnectJobMessenger has completed and we are finished with the
SSLConnectJobMessenger.

+  SSLConnectJobMessenger(const base::Closure& messenger_finished_callback);
   ~SSLConnectJobMessenger();
 
   // Removes |socket| from the set of sockets being monitored. This
@@ -151,18 +153,30 @@ class SSLConnectJobMessenger {
   void RunAllCallbacks(
       const SSLPendingSocketsAndCallbacks& pending_socket_and_callbacks);
 
-  base::WeakPtrFactory<SSLConnectJobMessenger> weak_factory_;
-
   SSLPendingSocketsAndCallbacks pending_sockets_and_callbacks_;
   // Note: this field is a vector to allow for future design changes. Currently,
   // this vector should only ever have one entry.
   std::vector<SSLClientSocket*> connecting_sockets_;
+
+  base::Closure messenger_finished_callback_;
+
+  base::WeakPtrFactory<SSLConnectJobMessenger> weak_factory_;
 };
 
 // SSLConnectJob handles the SSL handshake after setting up the underlying
 // connection as specified in the params.
 class SSLConnectJob : public ConnectJob {
  public:
+  // Callback to allow the SSLConnectJob to obtain an SSLConnectJobMessenger to
+  // coordinate connecting. The SSLConnectJob will supply a unique identifer
+  // (ex: the SSL session cache key), with the expectation that the same
+  // Messenger will be returned for all such ConnectJobs.
+  //
+  // Note: It will only be called for situations where the SSL session cache
+  // does not already have a candidate session to resume.
+  typedef base::Callback<SSLConnectJobMessenger*(const std::string&)>
+      GetMessengerCallback;
+
   // Note: the SSLConnectJob does not own |messenger| so it must outlive the
   // job.
   SSLConnectJob(const std::string& group_name,
@@ -175,7 +189,7 @@ class SSLConnectJob : public ConnectJob {
                 ClientSocketFactory* client_socket_factory,
                 HostResolver* host_resolver,
                 const SSLClientSocketContext& context,
-                SSLConnectJobMessenger* messenger,
+                const GetMessengerCallback& get_messenger_callback,
                 Delegate* delegate,
                 NetLog* net_log);
   virtual ~SSLConnectJob();
@@ -245,6 +259,8 @@ class SSLConnectJob : public ConnectJob {
   SSLConnectJobMessenger* messenger_;
   HttpResponseInfo error_response_info_;
 
+  GetMessengerCallback get_messenger_callback_;
+
   base::WeakPtrFactory<SSLConnectJob> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(SSLConnectJob);
@@ -330,8 +346,16 @@ class NET_EXPORT_PRIVATE SSLClientSocketPool
   // HigherLayeredPool implementation.
   virtual bool CloseOneIdleConnection() OVERRIDE;
 
+  // Gets the SSLConnectJobMessenger for the given ssl session |cache_key|. If
+  // none exits, it creates one and stores it in |messenger_map_|.
+  SSLConnectJobMessenger* GetOrCreateSSLConnectJobMessenger(
+      const std::string& cache_key);
+  void DeleteSSLConnectJobMessenger(const std::string& cache_key);
+
  private:
   typedef ClientSocketPoolBase<SSLSocketParams> PoolBase;
+  // Maps SSLConnectJob cache keys to SSLConnectJobMessenger objects.
+  typedef std::map<std::string, SSLConnectJobMessenger*> MessengerMap;
 
   // SSLConfigService::Observer implementation.
 
@@ -341,14 +365,15 @@ class NET_EXPORT_PRIVATE SSLClientSocketPool
 
   class SSLConnectJobFactory : public PoolBase::ConnectJobFactory {
    public:
-    SSLConnectJobFactory(TransportClientSocketPool* transport_pool,
-                         SOCKSClientSocketPool* socks_pool,
-                         HttpProxyClientSocketPool* http_proxy_pool,
-                         ClientSocketFactory* client_socket_factory,
-                         HostResolver* host_resolver,
-                         const SSLClientSocketContext& context,
-                         bool enable_ssl_connect_job_waiting,
-                         NetLog* net_log);
+    SSLConnectJobFactory(
+        TransportClientSocketPool* transport_pool,
+        SOCKSClientSocketPool* socks_pool,
+        HttpProxyClientSocketPool* http_proxy_pool,
+        ClientSocketFactory* client_socket_factory,
+        HostResolver* host_resolver,
+        const SSLClientSocketContext& context,
+        const SSLConnectJob::GetMessengerCallback& get_messenger_callback,
+        NetLog* net_log);
 
     virtual ~SSLConnectJobFactory();
 
@@ -361,9 +386,6 @@ class NET_EXPORT_PRIVATE SSLClientSocketPool
     virtual base::TimeDelta ConnectionTimeout() const OVERRIDE;
 
    private:
-    // Maps SSLConnectJob cache keys to SSLConnectJobMessenger objects.
-    typedef std::map<std::string, SSLConnectJobMessenger*> MessengerMap;
-
     TransportClientSocketPool* const transport_pool_;
     SOCKSClientSocketPool* const socks_pool_;
     HttpProxyClientSocketPool* const http_proxy_pool_;
@@ -371,13 +393,8 @@ class NET_EXPORT_PRIVATE SSLClientSocketPool
     HostResolver* const host_resolver_;
     const SSLClientSocketContext context_;
     base::TimeDelta timeout_;
-    bool enable_ssl_connect_job_waiting_;
+    SSLConnectJob::GetMessengerCallback get_messenger_callback_;
     NetLog* net_log_;
-    // |messenger_map_| is currently a pointer so that an element can be
-    // added to it inside of the const method NewConnectJob. In the future,
-    // elements will be added in a different method.
-    // TODO(mshelley) Change this to a non-pointer.
-    scoped_ptr<MessengerMap> messenger_map_;
 
     DISALLOW_COPY_AND_ASSIGN(SSLConnectJobFactory);
   };
@@ -387,6 +404,8 @@ class NET_EXPORT_PRIVATE SSLClientSocketPool
   HttpProxyClientSocketPool* const http_proxy_pool_;
   PoolBase base_;
   const scoped_refptr<SSLConfigService> ssl_config_service_;
+  MessengerMap messenger_map_;
+  bool enable_ssl_connect_job_waiting_;
 
   DISALLOW_COPY_AND_ASSIGN(SSLClientSocketPool);
 };