[SPDY] Fix memory leak introduced by r194564

The leak is due to too much passing around of an IOBuffer via
a raw pointer.

BUG=232345
TBR=rch@chromium.org

Review URL: https://codereview.chromium.org/14087008

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@194577 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 10 insertions, 1 deletions

diff --git a/net/spdy/spdy_session.cc b/net/spdy/spdy_session.cc
index f705731..ba84ea1 100644
--- a/net/spdy/spdy_session.cc
+++ b/net/spdy/spdy_session.cc
@@ -1103,13 +1103,22 @@ void SpdySession::WriteSocket() {
     }
 
     write_pending_ = true;
+    // Explicitly store in a scoped_refptr<IOBuffer> to avoid problems
+    // with net::Socket implementations that don't store their
+    // IOBuffer argument in a scoped_refptr<IOBuffer> (see
+    // crbug.com/232345).
+    scoped_refptr<IOBuffer> write_io_buffer =
+        in_flight_write_->GetIOBufferForRemainingData();
     // We keep |in_flight_write_| alive until OnWriteComplete(), so
     // it's okay to use GetIOBufferForRemainingData() since the socket
     // doesn't use the IOBuffer past OnWriteComplete().
     int rv = connection_->socket()->Write(
-        in_flight_write_->GetIOBufferForRemainingData(),
+        write_io_buffer,
         in_flight_write_->GetRemainingSize(),
         base::Bind(&SpdySession::OnWriteComplete, weak_factory_.GetWeakPtr()));
+    // Avoid persisting |write_io_buffer| past |in_flight_write_|'s
+    // lifetime (which will end if OnWriteComplete() is called below).
+    write_io_buffer = NULL;
     if (rv == net::ERR_IO_PENDING)
       break;