Don't copy the QuicAckFrame into the QuicPacketGenerator. Protected by quic_dont_copy_acks.

net/quic/quic_connection.cc

Index: net/quic/quic_connection.cc
diff --git a/net/quic/quic_connection.cc b/net/quic/quic_connection.cc
index afd5e50e4e401d832fcc311d610e09f3305b5e8b..300028d819804a4c0c23ad8c04eb7c6cbe8f76d5 100644
--- a/net/quic/quic_connection.cc
+++ b/net/quic/quic_connection.cc
@@ -585,6 +585,13 @@ bool QuicConnection::OnUnauthenticatedHeader(const QuicPacketHeader& header) {
                                    "when multipath is not enabled.");
     return false;
   }
+  if (!packet_generator_.IsPendingPacketEmpty()) {
+    QUIC_BUG << "Pending frames must be serialized before incoming packets are "
+             << "processed, because that may change a queued ack frame.";
+    SendConnectionCloseWithDetails(QUIC_INTERNAL_ERROR,
+                                   "Should not process packets while sending.");
+    return false;
+  }
 
   // If this packet has already been seen, or the sender has told us that it
   // will not be retransmitted, then stop processing the packet.
@@ -1029,6 +1036,10 @@ void QuicConnection::PopulateAckFrame(QuicAckFrame* ack) {
                                                     clock_->ApproximateNow());
 }
 
+const QuicFrame QuicConnection::GetUpdatedAckFrame() {
+  return received_packet_manager_.GetUpdatedAckFrame(clock_->ApproximateNow());
+}
+
 void QuicConnection::PopulateStopWaitingFrame(
     QuicStopWaitingFrame* stop_waiting) {
   stop_waiting->least_unacked = GetLeastUnacked();