Fix a crash in net::SSLClientSocketWin::OnIOComplete(int) when

an HttpNetworkTransaction is destroyed while its SSLClientSocket
is verifying a certificate.

Document that ClientSocket::Disconnect aborts any pending IO and
prevents completion callback from running, like a cancel method.

Change the verifier_ member of SSLClientSocket to a scoped_ptr so
that we can destroy the CertVerifier object in the Disconnect method.
(CertVerifier doesn't have a cancel method, so we cancel pending
certificate verification by destroying the CertVerifier object.)

R=willchan
BUG=http://crbug.com/13981
TEST=none.  I can only reproduce this crash by modifying the
source code to create that condition.
Review URL: http://codereview.chromium.org/147159

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@19307 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 8 insertions, 4 deletions

diff --git a/net/socket/client_socket.h b/net/socket/client_socket.h
index 54866b8..d406fc7 100644
--- a/net/socket/client_socket.h
+++ b/net/socket/client_socket.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -33,9 +33,13 @@ class ClientSocket : public Socket {
   //
   virtual int Connect(CompletionCallback* callback) = 0;
 
-  // Called to disconnect a connected socket.  Does nothing if the socket is
-  // already disconnected.  After calling Disconnect it is possible to call
-  // Connect again to establish a new connection.
+  // Called to disconnect a socket.  Does nothing if the socket is already
+  // disconnected.  After calling Disconnect it is possible to call Connect
+  // again to establish a new connection.
+  //
+  // If IO (Connect, Read, or Write) is pending when the socket is
+  // disconnected, the pending IO is cancelled, and the completion callback
+  // will not be called.
   virtual void Disconnect() = 0;
 
   // Called to test if the connection is still alive.  Returns false if a