Merge 66630 - Fix SPDY crash on race when canceling a stream that just got cr...

net/spdy/spdy_session.h

Index: net/spdy/spdy_session.h
===================================================================
--- net/spdy/spdy_session.h	(revision 66644)
+++ net/spdy/spdy_session.h	(working copy)
@@ -218,6 +218,18 @@
   typedef std::map<std::string, scoped_refptr<SpdyStream> > PushedStreamMap;
   typedef std::priority_queue<SpdyIOBuffer> OutputQueue;
 
+  struct CallbackResultPair {
+    CallbackResultPair() : callback(NULL), result(OK) {}
+    CallbackResultPair(CompletionCallback* callback_in, int result_in)
+        : callback(callback_in), result(result_in) {}
+
+    CompletionCallback* callback;
+    int result;
+  };
+
+  typedef std::map<const scoped_refptr<SpdyStream>*, CallbackResultPair>
+      PendingCallbackMap;
+
   virtual ~SpdySession();
 
   void ProcessPendingCreateStreams();
@@ -297,7 +309,7 @@
 
   // Invokes a user callback for stream creation.  We provide this method so it
   // can be deferred to the MessageLoop, so we avoid re-entrancy problems.
-  void InvokeUserStreamCreationCallback(CompletionCallback* callback, int rv);
+  void InvokeUserStreamCreationCallback(scoped_refptr<SpdyStream>* stream);
 
   // Callbacks for the Spdy session.
   CompletionCallbackImpl<SpdySession> read_callback_;
@@ -309,6 +321,11 @@
   // method.
   ScopedRunnableMethodFactory<SpdySession> method_factory_;
 
+  // Map of the SpdyStreams for which we have a pending Task to invoke a
+  // callback.  This is necessary since, before we invoke said callback, it's
+  // possible that the request is cancelled.
+  PendingCallbackMap pending_callback_map_;
+
   // The domain this session is connected to.
   const HostPortProxyPair host_port_proxy_pair_;