Use base::MakeRefCounted instead of new to alloc net::IOBuffer instances.

This CL only handles a difficult case in //net. The easy cases were
tackled by mechanical CLs, such as https://crrev.com/c/1188959 for
//net. Parallel CLs will tackle other difficult cases.

ability to reason about instance ownership locally, creating instances
via base::MakeRefCounted makes it possible to use 1-based ref-counting
in the future (see base/memory/ref_counted.h).

net: :IOBuffer is (thread-safe) ref-counted. Asides from improving the
Change-Id: I9925444170fcb8ab3740c1a1223c10c5d4060775
Reviewed-on: https://chromium-review.googlesource.com/1215465Reviewed-by: Bence Béky <bnc@chromium.org>
Commit-Queue: Victor Costan <pwnall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#590268}

net/spdy/spdy_buffer.cc

@@ -93,8 +93,8 @@ void SpdyBuffer::Consume(size_t consume_size) {
   ConsumeHelper(consume_size, CONSUME);
 }
 
-IOBuffer* SpdyBuffer::GetIOBufferForRemainingData() {
-  return new SharedFrameIOBuffer(shared_frame_, offset_);
+scoped_refptr<IOBuffer> SpdyBuffer::GetIOBufferForRemainingData() {
+  return base::MakeRefCounted<SharedFrameIOBuffer>(shared_frame_, offset_);
 }
 
 size_t SpdyBuffer::EstimateMemoryUsage() const {

net/spdy/spdy_buffer.h

@@ -84,7 +84,7 @@ class NET_EXPORT_PRIVATE SpdyBuffer {
   // This is used with Socket::Write(), which takes an IOBuffer* that
   // may be written to even after the socket itself is destroyed. (See
   // http://crbug.com/249725 .)
-  IOBuffer* GetIOBufferForRemainingData();
+  scoped_refptr<IOBuffer> GetIOBufferForRemainingData();
 
   // Returns the estimate of dynamically allocated memory in bytes.
   size_t EstimateMemoryUsage() const;

net/spdy/spdy_session.cc

@@ -2277,9 +2277,6 @@ int SpdySession::DoWrite() {
 
   write_state_ = WRITE_STATE_DO_WRITE_COMPLETE;
 
-  // Explicitly store in a scoped_refptr<IOBuffer> to avoid problems
-  // with Socket implementations that don't store their IOBuffer
-  // argument in a scoped_refptr<IOBuffer> (see crbug.com/232345).
   scoped_refptr<IOBuffer> write_io_buffer =
       in_flight_write_->GetIOBufferForRemainingData();
   return connection_->socket()->Write(