Fix SPDY crash on race when canceling a stream that just got created.

net/spdy/spdy_session.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SPDY_SPDY_SESSION_H_
 #define NET_SPDY_SPDY_SESSION_H_
 #pragma once
 
 #include <deque>
 #include <list>
@@ skipping 212 matching lines @@
         : url(&url), priority(priority), spdy_stream(spdy_stream),
           stream_net_log(&stream_net_log), callback(callback) { }
   };
   typedef std::queue<PendingCreateStream, std::list< PendingCreateStream> >
       PendingCreateStreamQueue;
   typedef std::map<int, scoped_refptr<SpdyStream> > ActiveStreamMap;
   // Only HTTP push a stream.
   typedef std::map<std::string, scoped_refptr<SpdyStream> > PushedStreamMap;
   typedef std::priority_queue<SpdyIOBuffer> OutputQueue;
 
+  struct CallbackResultPair {
+    CallbackResultPair() : callback(NULL), result(OK) {}
+    CallbackResultPair(CompletionCallback* callback_in, int result_in)
+        : callback(callback_in), result(result_in) {}
+
+    CompletionCallback* callback;
+    int result;
+  };
+
+  typedef std::map<const scoped_refptr<SpdyStream>*, CallbackResultPair>
+      PendingCallbackMap;
+
   virtual ~SpdySession();
 
   void ProcessPendingCreateStreams();
   int CreateStreamImpl(
       const GURL& url,
       RequestPriority priority,
       scoped_refptr<SpdyStream>* spdy_stream,
       const BoundNetLog& stream_net_log);
 
   // SpdyFramerVisitorInterface
@@ skipping 59 matching lines @@
   bool Respond(const spdy::SpdyHeaderBlock& headers,
                const scoped_refptr<SpdyStream> stream);
 
   void RecordHistograms();
 
   // Closes all streams.  Used as part of shutdown.
   void CloseAllStreams(net::Error status);
 
   // Invokes a user callback for stream creation.  We provide this method so it
   // can be deferred to the MessageLoop, so we avoid re-entrancy problems.
-  void InvokeUserStreamCreationCallback(CompletionCallback* callback, int rv);
+  void InvokeUserStreamCreationCallback(scoped_refptr<SpdyStream>* stream);
 
   // Callbacks for the Spdy session.
   CompletionCallbackImpl<SpdySession> read_callback_;
   CompletionCallbackImpl<SpdySession> write_callback_;
 
   // Used for posting asynchronous IO tasks.  We use this even though
   // SpdySession is refcounted because we don't need to keep the SpdySession
   // alive if the last reference is within a RunnableMethod.  Just revoke the
   // method.
   ScopedRunnableMethodFactory<SpdySession> method_factory_;
 
+  // Map of the SpdyStreams for which we have a pending Task to invoke a
+  // callback.  This is necessary since, before we invoke said callback, it's
+  // possible that the request is cancelled.
+  PendingCallbackMap pending_callback_map_;
+
   // The domain this session is connected to.
   const HostPortProxyPair host_port_proxy_pair_;
 
   // |spdy_session_pool_| owns us, therefore its lifetime must exceed ours.  We
   // set this to NULL after we are removed from the pool.
   SpdySessionPool* spdy_session_pool_;
   SpdySettingsStorage* const spdy_settings_;
 
   // The socket handle for this session.
   scoped_ptr<ClientSocketHandle> connection_;
@@ skipping 95 matching lines @@
   const linked_ptr<spdy::SpdyHeaderBlock> headers_;
   const spdy::SpdyControlFlags flags_;
   const spdy::SpdyStreamId id_;
 
   DISALLOW_COPY_AND_ASSIGN(NetLogSpdySynParameter);
 };
 
 }  // namespace net
 
 #endif  // NET_SPDY_SPDY_SESSION_H_