Fixes use-after-free bug in QUIC.

net/quic/quic_spdy_stream.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // The base class for streams which deliver data to/from an application.
 // In each direction, the data on such a stream first contains compressed
 // headers then body data.
 
 #ifndef NET_QUIC_QUIC_SPDY_STREAM_H_
 #define NET_QUIC_QUIC_SPDY_STREAM_H_
@@ skipping 143 matching lines @@
   const SpdyHeaderBlock& received_trailers() const {
     return received_trailers_;
   }
 
   virtual SpdyPriority priority() const;
 
   // Sets priority_ to priority.  This should only be called before bytes are
   // written to the server.
   void SetPriority(SpdyPriority priority);
 
+  // Called when owning session is getting deleted to avoid subsequent
+  // use of the spdy_session_ member.
+  void ClearSession();
+
  protected:
   // Called by OnStreamHeadersComplete depending on which type (initial or
   // trailing) headers are expected next.
   virtual void OnInitialHeadersComplete(bool fin, size_t frame_len);
   virtual void OnTrailingHeadersComplete(bool fin, size_t frame_len);
   QuicSpdySession* spdy_session() const { return spdy_session_; }
   Visitor* visitor() { return visitor_; }
 
   // Returns true if headers have been fully read and consumed.
   bool FinishedReadingHeaders() const;
@@ skipping 24 matching lines @@
   std::string decompressed_trailers_;
   // The parsed trailers received from the peer.
   SpdyHeaderBlock received_trailers_;
 
   DISALLOW_COPY_AND_ASSIGN(QuicSpdyStream);
 };
 
 }  // namespace net
 
 #endif  // NET_QUIC_QUIC_SPDY_STREAM_H_