QUIC - fix crash when writing part of the request body fails

net/quic/quic_http_stream.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_http_stream.h"
 
 #include "base/callback_helpers.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/stringprintf.h"
 #include "net/base/io_buffer.h"
@@ skipping 453 matching lines @@
       raw_request_body_buf_.get(), raw_request_body_buf_->size(),
       base::Bind(&QuicHttpStream::OnIOComplete, weak_factory_.GetWeakPtr()));
 }
 
 int QuicHttpStream::DoReadRequestBodyComplete(int rv) {
   // |rv| is the result of read from the request body from the last call to
   // DoSendBody().
   if (rv < 0)
     return rv;
 
+  // If the stream is already closed, don't continue.
+  if (!stream_)
+    return response_status_;
+
   request_body_buf_ = new DrainableIOBuffer(raw_request_body_buf_.get(), rv);
   if (rv == 0) {  // Reached the end.
     DCHECK(request_body_stream_->IsEOF());
   }
 
   next_state_ = STATE_SEND_BODY;
   return OK;
 }
 
 int QuicHttpStream::DoSendBody() {
@@ skipping 13 matching lines @@
   }
 
   next_state_ = STATE_OPEN;
   return OK;
 }
 
 int QuicHttpStream::DoSendBodyComplete(int rv) {
   if (rv < 0)
     return rv;
 
+  // If the stream is already closed, don't continue.
+  if (!stream_)
+    return response_status_;
+
   request_body_buf_->DidConsume(request_body_buf_->BytesRemaining());
 
   if (!request_body_stream_->IsEOF()) {
     next_state_ = STATE_READ_REQUEST_BODY;
     return OK;
   }
 
   next_state_ = STATE_OPEN;
   return OK;
 }
@@ skipping 42 matching lines @@
   closed_stream_sent_bytes_ = stream_->stream_bytes_written();
   stream_ = nullptr;
 
   // If |request_body_stream_| is non-NULL, Reset it, to abort any in progress
   // read.
   if (request_body_stream_)
     request_body_stream_->Reset();
 }
 
 }  // namespace net