relnote: Protect against a QUIC crash bug but logging a DFATAL and

net/quic/quic_packet_generator_test.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_packet_generator.h"
 
 #include <string>
 
 #include "net/quic/crypto/crypto_protocol.h"
 #include "net/quic/crypto/null_encrypter.h"
@@ skipping 1607 matching lines @@
   PacketContents probe_contents;
   probe_contents.num_mtu_discovery_frames = 1;
 
   CheckPacketHasSingleStreamFrame(0);
   CheckPacketHasSingleStreamFrame(1);
   CheckPacketContains(probe_contents, 2);
   CheckPacketHasSingleStreamFrame(3);
   CheckPacketHasSingleStreamFrame(4);
 }
 
+TEST_P(QuicPacketGeneratorTest, DontCrashOnInvalidStopWaiting) {
+  // Test added to ensure the generator does not crash when an invalid frame is
+  // added.  Because this is an indication of internal programming errors,
+  // DFATALs are expected.
+  // A 1 byte sequence number length can't encode a gap of 1000.
+  QuicPacketCreatorPeer::SetSequenceNumber(creator_, 1000);
+
+  delegate_.SetCanNotWrite();
+  generator_.SetShouldSendAck(true);
+  delegate_.SetCanWriteAnything();
+  generator_.StartBatchOperations();
+
+  // Set up frames to write into the creator when control frames are written.
+  EXPECT_CALL(delegate_, PopulateAckFrame(_));
+  EXPECT_CALL(delegate_, PopulateStopWaitingFrame(_));
+  // Generator should have queued control frames, and creator should be empty.
+  EXPECT_TRUE(generator_.HasQueuedFrames());
+  EXPECT_FALSE(creator_->HasPendingFrames());
+
+  // This will not serialize any packets, because of the invalid frame.
+  EXPECT_CALL(delegate_,
+              CloseConnection(QUIC_FAILED_TO_SERIALIZE_PACKET, false));
+  EXPECT_DFATAL(generator_.FinishBatchOperations(),
+                "sequence_number_length 1 is too small "
+                "for least_unacked_delta: 1001");
+}
+
 }  // namespace test
 }  // namespace net