Fix crash on fallback in HttpNetworkTransaction::ReconsiderProxyAfterError().

If the socket doesn't exist, don't try to Disconnect() it.
BUG=http://www.crbug.com/13375
TEST=See bug for repro.

Review URL: http://codereview.chromium.org/119228

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@17808 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 48 insertions, 1 deletions

diff --git a/net/http/http_network_transaction.cc b/net/http/http_network_transaction.cc
index f65cabc..5795011 100644
--- a/net/http/http_network_transaction.cc
+++ b/net/http/http_network_transaction.cc
@@ -1337,7 +1337,10 @@ int HttpNetworkTransaction::ReconsiderProxyAfterError(int error) {
   int rv = session_->proxy_service()->ReconsiderProxyAfterError(
       request_->url, &proxy_info_, &io_callback_, &pac_request_);
   if (rv == OK || rv == ERR_IO_PENDING) {
-    connection_.socket()->Disconnect();
+    // If the error was during connection setup, there is no socket to
+    // disconnect.
+    if (connection_.socket())
+      connection_.socket()->Disconnect();
     connection_.Reset();
     DCHECK(!request_headers_bytes_sent_);
     next_state_ = STATE_RESOLVE_PROXY_COMPLETE;
diff --git a/net/http/http_network_transaction_unittest.cc b/net/http/http_network_transaction_unittest.cc
index ae39b51..a4551e8 100644
--- a/net/http/http_network_transaction_unittest.cc
+++ b/net/http/http_network_transaction_unittest.cc
@@ -7,6 +7,7 @@
 #include "base/compiler_specific.h"
 #include "net/base/client_socket_factory.h"
 #include "net/base/completion_callback.h"
+#include "net/base/host_resolver_unittest.h"
 #include "net/base/socket_test_util.h"
 #include "net/base/ssl_client_socket.h"
 #include "net/base/ssl_info.h"
@@ -24,6 +25,20 @@
 
 namespace net {
 
+namespace {
+
+// Config getter that returns a single config.
+class DummyProxyConfigService : public ProxyConfigService {
+ public:
+  // ProxyConfigService implementation:
+  virtual int GetProxyConfig(ProxyConfig* config) {
+    config->proxy_rules.ParseFromString("foobar:80");
+    return OK;
+  }
+};
+
+}  // namespace
+
 // Create a proxy service which fails on all requests (falls back to direct).
 ProxyService* CreateNullProxyService() {
   return ProxyService::CreateNull();
@@ -3094,4 +3109,33 @@ TEST_F(HttpNetworkTransactionTest, BuildRequest_ExtraHeaders) {
   EXPECT_EQ(OK, rv);
 }
 
+TEST_F(HttpNetworkTransactionTest, ReconsiderProxyAfterFailedConnection) {
+  scoped_refptr<RuleBasedHostMapper> host_mapper(new RuleBasedHostMapper());
+  ScopedHostMapper scoped_host_mapper(host_mapper.get());
+  host_mapper->AddSimulatedFailure("*");
+
+  SessionDependencies session_deps;
+  scoped_ptr<HttpTransaction> trans(
+      new HttpNetworkTransaction(
+          CreateSession(&session_deps),
+          &session_deps.socket_factory));
+
+  HttpRequestInfo request;
+  request.method = "GET";
+  request.url = GURL("http://www.google.com/");
+
+  TestCompletionCallback callback;
+
+  int rv = trans->Start(&request, &callback);
+  EXPECT_EQ(ERR_IO_PENDING, rv);
+
+  // Set another config service so that ReconsiderProxyAfterError will fallback
+  // to another proxy config.
+  session_deps.proxy_service->ResetConfigService(
+      new DummyProxyConfigService());
+
+  rv = callback.WaitForResult();
+  EXPECT_EQ(ERR_NAME_NOT_RESOLVED, rv);
+}
+
 }  // namespace net