Fixes use-after-free bug in QUIC.

net/quic/quic_spdy_session.cc

Index: net/quic/quic_spdy_session.cc
diff --git a/net/quic/quic_spdy_session.cc b/net/quic/quic_spdy_session.cc
index 593e3a0276dee8ad1314bf1f4f158661e75d9d01..071d0118aff93c72e0b721896dd873edc55bdf23 100644
--- a/net/quic/quic_spdy_session.cc
+++ b/net/quic/quic_spdy_session.cc
@@ -16,7 +16,16 @@ QuicSpdySession::QuicSpdySession(QuicConnection* connection,
                                  const QuicConfig& config)
     : QuicSession(connection, config) {}
 
-QuicSpdySession::~QuicSpdySession() {}
+QuicSpdySession::~QuicSpdySession() {
+  // Set the streams' session pointers in closed and dynamic stream lists
+  // to null to avoid subsequent use of this session.
+  for (auto const& stream : *closed_streams()) {
+    static_cast<QuicSpdyStream*>(stream)->ClearSession();
+  }
+  for (auto const& kv : dynamic_streams()) {
+    static_cast<QuicSpdyStream*>(kv.second)->ClearSession();
+  }
+}
 
 void QuicSpdySession::Initialize() {
   QuicSession::Initialize();