Revert a workaround commit for a UAF crash.

net/socket_stream/socket_stream.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // TODO(ukai): code is similar with http_network_transaction.cc.  We should
 //   think about ways to share code, if possible.
 
 #include "net/socket_stream/socket_stream.h"
 
 #include <set>
@@ skipping 72 matching lines @@
 void SocketStream::ResponseHeaders::Realloc(size_t new_size) {
   headers_.reset(static_cast<char*>(realloc(headers_.release(), new_size)));
 }
 
 SocketStream::ResponseHeaders::~ResponseHeaders() { data_ = NULL; }
 
 SocketStream::SocketStream(const GURL& url, Delegate* delegate)
     : delegate_(delegate),
       url_(url),
       max_pending_send_allowed_(kMaxPendingSendAllowed),
+      context_(NULL),
       next_state_(STATE_NONE),
       factory_(ClientSocketFactory::GetDefaultFactory()),
       proxy_mode_(kDirectConnection),
       proxy_url_(url),
       pac_request_(NULL),
       privacy_mode_(kPrivacyModeDisabled),
       // Unretained() is required; without it, Bind() creates a circular
       // dependency and the SocketStream object will not be freed.
       io_callback_(base::Bind(&SocketStream::OnIOCompleted,
                               base::Unretained(this))),
@@ skipping 20 matching lines @@
 
 void SocketStream::SetUserData(const void* key, UserData* data) {
   user_data_[key] = linked_ptr<UserData>(data);
 }
 
 bool SocketStream::is_secure() const {
   return url_.SchemeIs("wss");
 }
 
 void SocketStream::set_context(URLRequestContext* context) {
-  const URLRequestContext* prev_context = context_.get();
+  const URLRequestContext* prev_context = context_;
 
-  if (context) {
-    context_ = context->AsWeakPtr();
-  } else {
-    context_.reset();
-  }
+  context_ = context;
 
   if (prev_context != context) {
     if (prev_context && pac_request_) {
       prev_context->proxy_service()->CancelPacRequest(pac_request_);
       pac_request_ = NULL;
     }
 
     net_log_.EndEvent(NetLog::TYPE_REQUEST_ALIVE);
     net_log_ = BoundNetLog();
 
     if (context) {
       net_log_ = BoundNetLog::Make(
           context->net_log(),
           NetLog::SOURCE_SOCKET_STREAM);
 
       net_log_.BeginEvent(NetLog::TYPE_REQUEST_ALIVE);
     }
   }
 }
 
 void SocketStream::CheckPrivacyMode() {
-  if (context_.get() && context_->network_delegate()) {
+  if (context_ && context_->network_delegate()) {
     bool enable = context_->network_delegate()->CanEnablePrivacyMode(url_,
                                                                      url_);
     privacy_mode_ = enable ? kPrivacyModeEnabled : kPrivacyModeDisabled;
     // Disable Channel ID if privacy mode is enabled.
     if (enable)
       server_ssl_config_.channel_id_enabled = false;
   }
 }
 
 void SocketStream::Connect() {
   DCHECK(base::MessageLoop::current())
       << "The current base::MessageLoop must exist";
   DCHECK_EQ(base::MessageLoop::TYPE_IO, base::MessageLoop::current()->type())
       << "The current base::MessageLoop must be TYPE_IO";
-  if (context_.get()) {
+  if (context_) {
     context_->ssl_config_service()->GetSSLConfig(&server_ssl_config_);
     proxy_ssl_config_ = server_ssl_config_;
   }
   CheckPrivacyMode();
 
   DCHECK_EQ(next_state_, STATE_NONE);
 
   AddRef();  // Released in Finish()
   // Open a connection asynchronously, so that delegate won't be called
   // back before returning Connect().
@@ skipping 257 matching lines @@
   waiting_for_write_completion_ = false;
   if (result > 0) {
     DidSendData(result);
     result = OK;
   }
   DoLoop(result);
 }
 
 void SocketStream::DoLoop(int result) {
   // If context was not set, close immediately.
-  if (!context_.get())
+  if (!context_)
     next_state_ = STATE_CLOSE;
 
   if (next_state_ == STATE_NONE)
     return;
 
   do {
     State state = next_state_;
     next_state_ = STATE_NONE;
     switch (state) {
       case STATE_BEFORE_CONNECT:
@@ skipping 105 matching lines @@
     // record the error.  In next iteration, it will close the connection.
     if (state != STATE_READ_WRITE && result < ERR_IO_PENDING) {
       net_log_.EndEventWithNetErrorCode(
           NetLog::TYPE_SOCKET_STREAM_CONNECT, result);
     }
   } while (result != ERR_IO_PENDING);
 }
 
 int SocketStream::DoBeforeConnect() {
   next_state_ = STATE_BEFORE_CONNECT_COMPLETE;
-  if (!context_.get() || !context_->network_delegate()) {
-    // TODO(yhirano): This should not be OK.
+  if (!context_ || !context_->network_delegate())
     return OK;
-  }
 
   int result = context_->network_delegate()->NotifyBeforeSocketStreamConnect(
       this, io_callback_);
   if (result != OK && result != ERR_IO_PENDING)
     next_state_ = STATE_CLOSE;
 
   return result;
 }
 
 int SocketStream::DoBeforeConnectComplete(int result) {
@@ skipping 693 matching lines @@
 
   next_state_ = STATE_TCP_CONNECT;
   DoLoop(OK);
 }
 
 int SocketStream::HandleCertificateError(int result) {
   DCHECK(IsCertificateError(result));
   SSLClientSocket* ssl_socket = static_cast<SSLClientSocket*>(socket_.get());
   DCHECK(ssl_socket);
 
-  if (!context_.get())
+  if (!context_)
     return result;
 
   if (SSLClientSocket::IgnoreCertError(result, LOAD_IGNORE_ALL_CERT_ERRORS)) {
     const HttpNetworkSession::Params* session_params =
         context_->GetNetworkSessionParams();
     if (session_params && session_params->ignore_certificate_errors)
       return OK;
   }
 
   if (!delegate_)
     return result;
 
   SSLInfo ssl_info;
   ssl_socket->GetSSLInfo(&ssl_info);
 
   TransportSecurityState::DomainState domain_state;
   const bool fatal = context_->transport_security_state() &&
       context_->transport_security_state()->GetDomainState(url_.host(),
           SSLConfigService::IsSNIAvailable(context_->ssl_config_service()),
           &domain_state) &&
       domain_state.ShouldSSLErrorsBeFatal();
 
   delegate_->OnSSLCertificateError(this, ssl_info, fatal);
   return ERR_IO_PENDING;
 }
 
 }  // namespace net