[SPDY] Avoid leaking bytes from the session flow control receive window

net/spdy/spdy_stream.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_stream.h"
 
 #include <limits>
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
@@ skipping 293 matching lines @@
   DCHECK_GE(send_window_size_, delta_window_size);
 
   send_window_size_ -= delta_window_size;
 
   net_log_.AddEvent(
       NetLog::TYPE_SPDY_STREAM_UPDATE_SEND_WINDOW,
       base::Bind(&NetLogSpdyStreamWindowUpdateCallback,
                  stream_id_, -delta_window_size, send_window_size_));
 }
 
-void SpdyStream::IncreaseRecvWindowSize(int32 delta_window_size) {
-  if (session_->flow_control_state() < SpdySession::FLOW_CONTROL_STREAM)
-    return;
-
-  // Call back into the session, since this is the only
-  // window-size-related function that is called by the delegate
-  // instead of by the session.
-  session_->IncreaseRecvWindowSize(delta_window_size);
-
-  // By the time a read is processed by the delegate, this stream may
-  // already be inactive.
-  if (!session_->IsStreamActive(stream_id_))
-    return;
-
-  DCHECK_GE(unacked_recv_window_bytes_, 0);
-  DCHECK_GE(recv_window_size_, unacked_recv_window_bytes_);
-  DCHECK_GE(delta_window_size, 1);
-  // Check for overflow.
-  DCHECK_LE(delta_window_size, kint32max - recv_window_size_);
-
-  recv_window_size_ += delta_window_size;
-  net_log_.AddEvent(
-      NetLog::TYPE_SPDY_STREAM_UPDATE_RECV_WINDOW,
-      base::Bind(&NetLogSpdyStreamWindowUpdateCallback,
-                 stream_id_, delta_window_size, recv_window_size_));
-
-  unacked_recv_window_bytes_ += delta_window_size;
-  if (unacked_recv_window_bytes_ >
-      session_->stream_initial_recv_window_size() / 2) {
-    session_->SendStreamWindowUpdate(
-        stream_id_, static_cast<uint32>(unacked_recv_window_bytes_));
-    unacked_recv_window_bytes_ = 0;
-  }
-}
-
 int SpdyStream::GetPeerAddress(IPEndPoint* address) const {
   return session_->GetPeerAddress(address);
 }
 
 int SpdyStream::GetLocalAddress(IPEndPoint* address) const {
   return session_->GetLocalAddress(address);
 }
 
 bool SpdyStream::WasEverUsed() const {
   return session_->WasEverUsed();
@@ skipping 122 matching lines @@
 
   if (!buffer) {
     metrics_.StopStream();
     session_->CloseStream(stream_id_, net::OK);
     // Note: |this| may be deleted after calling CloseStream.
     return;
   }
 
   size_t length = buffer->GetRemainingSize();
   DCHECK_LE(length, session_->GetDataFrameMaximumPayload());
-  if (session_->flow_control_state() >= SpdySession::FLOW_CONTROL_STREAM)
+  if (session_->flow_control_state() >= SpdySession::FLOW_CONTROL_STREAM) {
     DecreaseRecvWindowSize(static_cast<int32>(length));
+    buffer->AddConsumeCallback(
+        base::Bind(&SpdyStream::IncreaseRecvWindowSize,
+                   weak_ptr_factory_.GetWeakPtr()));
+  }
 
   // Track our bandwidth.
   metrics_.RecordBytes(length);
   recv_bytes_ += length;
   recv_last_byte_time_ = base::TimeTicks::Now();
 
   if (delegate_->OnDataReceived(buffer.Pass()) != net::OK) {
     // |delegate_| rejected the data.
     LogStreamError(ERR_SPDY_PROTOCOL_ERROR, "Delegate rejected the data");
     session_->CloseStream(stream_id_, ERR_SPDY_PROTOCOL_ERROR);
@@ skipping 410 matching lines @@
       recv_first_byte_time_ - send_time_);
   UMA_HISTOGRAM_TIMES("Net.SpdyStreamDownloadTime",
       recv_last_byte_time_ - recv_first_byte_time_);
   UMA_HISTOGRAM_TIMES("Net.SpdyStreamTime",
       recv_last_byte_time_ - send_time_);
 
   UMA_HISTOGRAM_COUNTS("Net.SpdySendBytes", send_bytes_);
   UMA_HISTOGRAM_COUNTS("Net.SpdyRecvBytes", recv_bytes_);
 }
 
+void SpdyStream::IncreaseRecvWindowSize(size_t delta_window_size) {
+  if (session_->flow_control_state() < SpdySession::FLOW_CONTROL_STREAM)
+    return;
+
+  // By the time a read is processed by the delegate, this stream may
+  // already be inactive.
+  if (!session_->IsStreamActive(stream_id_))
+    return;
+
+  DCHECK_GE(unacked_recv_window_bytes_, 0);
+  DCHECK_GE(recv_window_size_, unacked_recv_window_bytes_);
+  DCHECK_GE(delta_window_size, 1u);
+  // Check for overflow.
+  DCHECK_LE(delta_window_size,
+            static_cast<size_t>(kint32max - recv_window_size_));
+
+  recv_window_size_ += delta_window_size;
+  net_log_.AddEvent(
+      NetLog::TYPE_SPDY_STREAM_UPDATE_RECV_WINDOW,
+      base::Bind(&NetLogSpdyStreamWindowUpdateCallback,
+                 stream_id_, delta_window_size, recv_window_size_));
+
+  unacked_recv_window_bytes_ += delta_window_size;
+  if (unacked_recv_window_bytes_ >
+      session_->stream_initial_recv_window_size() / 2) {
+    session_->SendStreamWindowUpdate(
+        stream_id_, static_cast<uint32>(unacked_recv_window_bytes_));
+    unacked_recv_window_bytes_ = 0;
+  }
+}
+
 void SpdyStream::DecreaseRecvWindowSize(int32 delta_window_size) {
   DCHECK(session_->IsStreamActive(stream_id_));
   DCHECK_GE(session_->flow_control_state(), SpdySession::FLOW_CONTROL_STREAM);
   DCHECK_GE(delta_window_size, 1);
 
   // Since we never decrease the initial window size,
   // |delta_window_size| should never cause |recv_window_size_| to go
   // negative. If we do, it's a client-side bug, so we use
   // PROTOCOL_ERROR for lack of a better error code.
   if (delta_window_size > recv_window_size_) {
     session_->ResetStream(
         stream_id_, RST_STREAM_PROTOCOL_ERROR,
         "Invalid delta_window_size for DecreaseRecvWindowSize");
     NOTREACHED();
     return;
   }
 
   recv_window_size_ -= delta_window_size;
   net_log_.AddEvent(
       NetLog::TYPE_SPDY_STREAM_UPDATE_RECV_WINDOW,
       base::Bind(&NetLogSpdyStreamWindowUpdateCallback,
                  stream_id_, -delta_window_size, recv_window_size_));
 }
 
 }  // namespace net