Fixes use-after-free bug in QUIC.

net/quic/quic_spdy_session.cc

Index: net/quic/quic_spdy_session.cc
diff --git a/net/quic/quic_spdy_session.cc b/net/quic/quic_spdy_session.cc
index af92387004929c979a9a35195ea1ccd1393b2c1a..119974c1f136579690998cc0ec969817be988fa5 100644
--- a/net/quic/quic_spdy_session.cc
+++ b/net/quic/quic_spdy_session.cc
@@ -15,7 +15,16 @@ QuicSpdySession::QuicSpdySession(QuicConnection* connection,
                                  const QuicConfig& config)
     : QuicSession(connection, config) {}
 
-QuicSpdySession::~QuicSpdySession() {}
+QuicSpdySession::~QuicSpdySession() {
+  // Set the streams' session pointers in closed and dynamic stream lists
+  // to null to avoid subsequent use of this session.
+  for (auto const& stream : *closed_streams()) {
+    static_cast<QuicSpdyStream*>(stream)->ClearSession();
+  }
+  for (auto const& kv : dynamic_streams()) {
+    static_cast<QuicSpdyStream*>(kv.second)->ClearSession();
+  }
+}
 
 void QuicSpdySession::Initialize() {
   QuicSession::Initialize();