Fix SPDY crash on race when canceling a stream that just got created.

net/spdy/spdy_session.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_session.h"
 
 #include "base/basictypes.h"
 #include "base/linked_ptr.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
@@ skipping 255 matching lines @@
 
   if (connection_->is_initialized()) {
     // With Spdy we can't recycle sockets.
     connection_->socket()->Disconnect();
   }
 
   // Streams should all be gone now.
   DCHECK_EQ(0u, num_active_streams());
   DCHECK_EQ(0u, num_unclaimed_pushed_streams());
 
+  DCHECK(pending_callback_map_.empty());
+
   RecordHistograms();
 
   net_log_.EndEvent(NetLog::TYPE_SPDY_SESSION, NULL);
 }
 
 net::Error SpdySession::InitializeWithSocket(
     ClientSocketHandle* connection,
     bool is_secure,
     int certificate_error_code) {
   static base::StatsCounter spdy_sessions("spdy.sessions");
@@ skipping 67 matching lines @@
     bool no_pending_create_streams = true;
     for (int i = 0;i < NUM_PRIORITIES;++i) {
       if (!create_stream_queues_[i].empty()) {
         PendingCreateStream pending_create = create_stream_queues_[i].front();
         create_stream_queues_[i].pop();
         no_pending_create_streams = false;
         int error = CreateStreamImpl(*pending_create.url,
                                      pending_create.priority,
                                      pending_create.spdy_stream,
                                      *pending_create.stream_net_log);
+        scoped_refptr<SpdyStream>* stream = pending_create.spdy_stream;
+        DCHECK(!ContainsKey(pending_callback_map_, stream));
+        pending_callback_map_[stream] =
+            CallbackResultPair(pending_create.callback, error);
         MessageLoop::current()->PostTask(
             FROM_HERE,
             method_factory_.NewRunnableMethod(
-                &SpdySession::InvokeUserStreamCreationCallback,
-                pending_create.callback, error));
+                &SpdySession::InvokeUserStreamCreationCallback, stream));
         break;
       }
     }
     if (no_pending_create_streams)
       return;  // there were no streams in any queue
   }
 }
 
 void SpdySession::CancelPendingCreateStreams(
     const scoped_refptr<SpdyStream>* spdy_stream) {
+  PendingCallbackMap::iterator it = pending_callback_map_.find(spdy_stream);
+  if (it != pending_callback_map_.end()) {
+    pending_callback_map_.erase(it);
+    return;
+  }
+
   for (int i = 0;i < NUM_PRIORITIES;++i) {
     PendingCreateStreamQueue tmp;
     // Make a copy removing this trans
     while (!create_stream_queues_[i].empty()) {
       PendingCreateStream pending_create = create_stream_queues_[i].front();
       create_stream_queues_[i].pop();
       if (pending_create.spdy_stream != spdy_stream)
         tmp.push(pending_create);
     }
     // Now copy it back
@@ skipping 947 matching lines @@
           UMA_HISTOGRAM_CUSTOM_COUNTS("Net.SpdySettingsRetransRate",
                                       setting.second,
                                       1, 100, 50);
           break;
       }
     }
   }
 }
 
 void SpdySession::InvokeUserStreamCreationCallback(
-    CompletionCallback* callback, int rv) {
-  callback->Run(rv);
+    scoped_refptr<SpdyStream>* stream) {
+  PendingCallbackMap::iterator it = pending_callback_map_.find(stream);
+
+  // Exit if the request has already been cancelled.
+  if (it == pending_callback_map_.end())
+    return;
+
+  CompletionCallback* callback = it->second.callback;
+  int result = it->second.result;
+  pending_callback_map_.erase(it);
+  callback->Run(result);
 }
 
 }  // namespace net