Fix SPDY crash on race when canceling a stream that just got created.

net/spdy/spdy_session.h

Index: net/spdy/spdy_session.h
diff --git a/net/spdy/spdy_session.h b/net/spdy/spdy_session.h
index 24c8e42b3786794a89f07bbdf6f7c673fe58c9ce..7007d288698fc2c8b86092a9e2274a062250d1ee 100644
--- a/net/spdy/spdy_session.h
+++ b/net/spdy/spdy_session.h
@@ -230,6 +230,18 @@ class SpdySession : public base::RefCounted<SpdySession>,
   typedef std::map<std::string, scoped_refptr<SpdyStream> > PushedStreamMap;
   typedef std::priority_queue<SpdyIOBuffer> OutputQueue;
 
+  struct CallbackResultPair {
+    CallbackResultPair() : callback(NULL), result(OK) {}
+    CallbackResultPair(CompletionCallback* callback_in, int result_in)
+        : callback(callback_in), result(result_in) {}
+
+    CompletionCallback* callback;
+    int result;
+  };
+
+  typedef std::map<const scoped_refptr<SpdyStream>*, CallbackResultPair>
+      PendingCallbackMap;
+
   virtual ~SpdySession();
 
   void ProcessPendingCreateStreams();
@@ -309,7 +321,7 @@ class SpdySession : public base::RefCounted<SpdySession>,
 
   // Invokes a user callback for stream creation.  We provide this method so it
   // can be deferred to the MessageLoop, so we avoid re-entrancy problems.
-  void InvokeUserStreamCreationCallback(CompletionCallback* callback, int rv);
+  void InvokeUserStreamCreationCallback(scoped_refptr<SpdyStream>* stream);
 
   // Callbacks for the Spdy session.
   CompletionCallbackImpl<SpdySession> read_callback_;
@@ -321,6 +333,11 @@ class SpdySession : public base::RefCounted<SpdySession>,
   // method.
   ScopedRunnableMethodFactory<SpdySession> method_factory_;
 
+  // Map of the SpdyStreams for which we have a pending Task to invoke a
+  // callback.  This is necessary since, before we invoke said callback, it's
+  // possible that the request is cancelled.
+  PendingCallbackMap pending_callback_map_;
+
   // The domain this session is connected to.
   const HostPortProxyPair host_port_proxy_pair_;