[SPDY] Avoid leaking bytes from the session flow control receive window

net/spdy/spdy_buffer.cc

Index: net/spdy/spdy_buffer.cc
diff --git a/net/spdy/spdy_buffer.cc b/net/spdy/spdy_buffer.cc
index 3257befc8518a3b7a47d83d6e636a2da82dcab03..15edcab1e0ae7953bec1fdd99d2e221da24fbef8 100644
--- a/net/spdy/spdy_buffer.cc
+++ b/net/spdy/spdy_buffer.cc
@@ -6,6 +6,7 @@
 
 #include <cstring>
 
+#include "base/callback.h"
 #include "base/logging.h"
 #include "net/base/io_buffer.h"
 #include "net/spdy/spdy_protocol.h"
@@ -38,7 +39,10 @@ SpdyBuffer::SpdyBuffer(const char* data, size_t size) :
     frame_(MakeSpdyFrame(data, size)),
     offset_(0) {}
 
-SpdyBuffer::~SpdyBuffer() {}
+SpdyBuffer::~SpdyBuffer() {
+  if (GetRemainingSize() > 0)
+    Consume(GetRemainingSize());
+}
 
 const char* SpdyBuffer::GetRemainingData() const {
   return frame_->data() + offset_;
@@ -48,10 +52,18 @@ size_t SpdyBuffer::GetRemainingSize() const {
   return frame_->size() - offset_;
 }
 
+void SpdyBuffer::AddConsumeCallback(const ConsumeCallback& consume_callback) {
+  consume_callbacks_.push_back(consume_callback);
+}
+
 void SpdyBuffer::Consume(size_t consume_size) {
   DCHECK_GE(consume_size, 1u);
   DCHECK_LE(consume_size, GetRemainingSize());
   offset_ += consume_size;
+  for (std::vector<ConsumeCallback>::const_iterator it =
+           consume_callbacks_.begin(); it != consume_callbacks_.end(); ++it) {
+    it->Run(consume_size);

[Ryan Hamilton, 2013/04/16 23:41:32]

Is there any chance that executing one of these callbacks might result in the
buffer being deleted?  You could add a boolean member in_consume_ and
CHECK(!in_consume_) in the destructor.  Is that worth doing?  Alternatively, add
comments about ConsumeCallbacks not being allowed to delete the buffer?

[akalin, 2013/04/16 23:53:10]

I think for the ConsumeCallback's use case, it's better to just add a comment
that ConsumeCallbacks shouldn't cause the buffer to be deleted. Done.

[Ryan Hamilton, 2013/04/17 00:14:32]

sgtm

+  }
 };
 
 IOBuffer* SpdyBuffer::GetIOBufferForRemainingData() {