Fixes use-after-free bug in QUIC.

net/quic/quic_spdy_stream.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_spdy_stream.h"
 
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "net/quic/quic_bug_tracker.h"
 #include "net/quic/quic_spdy_session.h"
@@ skipping 20 matching lines @@
       priority_(kDefaultPriority),
       trailers_decompressed_(false) {
   DCHECK_NE(kCryptoStreamId, id);
   // Don't receive any callbacks from the sequencer until headers
   // are complete.
   sequencer()->SetBlockedUntilFlush();
   spdy_session_->RegisterStreamPriority(id, priority_);
 }
 
 QuicSpdyStream::~QuicSpdyStream() {
-  spdy_session_->UnregisterStreamPriority(id());
+  if (spdy_session_ != nullptr) {
+    spdy_session_->UnregisterStreamPriority(id());
+  }
 }
 
 void QuicSpdyStream::CloseWriteSide() {
   if (version() > QUIC_VERSION_28 && !fin_received() && !rst_received() &&
       sequencer()->ignore_read_data() && !rst_sent()) {
     DCHECK(fin_sent());
     // Tell the peer to stop sending further data.
     DVLOG(1) << ENDPOINT << "Send QUIC_STREAM_NO_ERROR on stream " << id();
     Reset(QUIC_STREAM_NO_ERROR);
   }
@@ skipping 242 matching lines @@
 bool QuicSpdyStream::FinishedReadingTrailers() const {
   // If no further trailing headers are expected, and the decompressed trailers
   // (if any) have been consumed, then reading of trailers is finished.
   bool no_more_trailers = fin_received() || trailers_decompressed_;
   return no_more_trailers && decompressed_trailers_.empty();
 }
 
 SpdyPriority QuicSpdyStream::priority() const {
   return priority_;
 }
+
+void QuicSpdyStream::ClearSession() {
+  spdy_session_ = nullptr;
+}
+
 }  // namespace net