Fixes use-after-free bug in QUIC.

net/quic/quic_spdy_session.cc

 // Copyright (c) 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_spdy_session.h"
 
 #include "net/quic/quic_bug_tracker.h"
 #include "net/quic/quic_headers_stream.h"
 
 using std::string;
 
 namespace net {
 
 QuicSpdySession::QuicSpdySession(QuicConnection* connection,
                                  const QuicConfig& config)
     : QuicSession(connection, config) {}
 
-QuicSpdySession::~QuicSpdySession() {}
+QuicSpdySession::~QuicSpdySession() {
+  // Set the streams' session pointers in closed and dynamic stream lists
+  // to null to avoid subsequent use of this session.
+  for (auto const& stream : *closed_streams()) {
+    static_cast<QuicSpdyStream*>(stream)->ClearSession();
+  }
+  for (auto const& kv : dynamic_streams()) {
+    static_cast<QuicSpdyStream*>(kv.second)->ClearSession();
+  }
+}
 
 void QuicSpdySession::Initialize() {
   QuicSession::Initialize();
 
   if (perspective() == Perspective::IS_SERVER) {
     set_largest_peer_created_stream_id(kHeadersStreamId);
   } else {
     QuicStreamId headers_stream_id = GetNextOutgoingStreamId();
     DCHECK_EQ(headers_stream_id, kHeadersStreamId);
   }
@@ skipping 78 matching lines @@
 void QuicSpdySession::OnPromiseHeadersComplete(QuicStreamId stream_id,
                                                QuicStreamId promised_stream_id,
                                                size_t frame_len) {
   string error = "OnPromiseHeadersComplete should be overriden in client code.";
   QUIC_BUG << error;
   connection()->CloseConnection(QUIC_INTERNAL_ERROR, error,
                                 ConnectionCloseBehavior::SILENT_CLOSE);
 }
 
 }  // namespace net