I added a function "void SpdySettingsStorage::Clear()". I added a call to this function "spdy_set...

net/spdy/spdy_settings_storage.h

Index: net/spdy/spdy_settings_storage.h
===================================================================
--- net/spdy/spdy_settings_storage.h	(revision 85710)
+++ net/spdy/spdy_settings_storage.h	(working copy)
@@ -22,12 +22,17 @@
 
   // Get a copy of the SpdySettings stored for a host.
   // If no settings are stored, returns an empty set of settings.
+  // NOTE: Since settings_map_ may be cleared, don't store the address of the
+  // return value.
   const spdy::SpdySettings& Get(const HostPortPair& host_port_pair) const;

[rkn1, 2011/05/20 16:57:37]

I'm not sure what the function "SpdySession::SendSettings()" is doing. It seems
like the return values from Get might be stored, but I am not sure. Can someone
take a look at that? Other than that, I don't think any values are being stored.

[willchan no longer on Chromium, 2011/05/20 21:29:47]

It looks like a minor bug. It's copying rather than using a const reference.
It's not storing the settings though. It'd copying the settings to send to the
server. It doesn't hold onto a reference long-term, so don't worry.

[wtc, 2011/05/20 23:04:28]

There is a comment that says the copying is intentional:

  // Note:  we're copying the settings here, so that we can potentially modify
  // the settings for the field trial.  When removing the field trial, make
  // this a reference to the const SpdySettings again.

[willchan no longer on Chromium, 2011/05/21 08:45:28]

Good catch. OK, if it's for a field trial, that makes sense. It doesn't have the
use after free danger though, so I think rkn's in the clear.

 
   // Save settings for a host.
   void Set(const HostPortPair& host_port_pair,
            const spdy::SpdySettings& settings);
 
+  // This clears out the settings_map_ object.
+  void Clear();
+
  private:
   typedef std::map<HostPortPair, spdy::SpdySettings> SettingsMap;