Update SPDY4 length field to exclude frame prefix length.

net/spdy/spdy_frame_builder.cc

Index: net/spdy/spdy_frame_builder.cc
diff --git a/net/spdy/spdy_frame_builder.cc b/net/spdy/spdy_frame_builder.cc
index 0f8d1e5c469dba94d2c589983a4ba483aacc3828..da11be0ca60dfad14c16da2759b825407955e82c 100644
--- a/net/spdy/spdy_frame_builder.cc
+++ b/net/spdy/spdy_frame_builder.cc
@@ -105,7 +105,11 @@ bool SpdyFrameBuilder::WriteFramePrefix(const SpdyFramer& framer,
   // Upstream DCHECK's that capacity_ is under the maximum frame size at this
   // point. Chromium does not, because of the large additional zlib inflation
   // factor we use. (Frame size is is still checked by OverwriteLength() below).
-  success &= WriteUInt16(capacity_);
+  if (type != DATA) {
+    success &= WriteUInt16(capacity_ - framer.GetControlFrameHeaderSize());
+  } else {
+    success &= WriteUInt16(capacity_ - framer.GetDataFrameMinimumSize());
+  }
   success &= WriteUInt8(type);
   success &= WriteUInt8(flags);
   success &= WriteUInt32(stream_id);
@@ -145,12 +149,8 @@ bool SpdyFrameBuilder::WriteBytes(const void* data, uint32 data_len) {
 }
 
 bool SpdyFrameBuilder::RewriteLength(const SpdyFramer& framer) {
-  if (framer.protocol_version() < 4) {
-    return OverwriteLength(framer,
-                           length_ - framer.GetControlFrameHeaderSize());
-  } else {
-    return OverwriteLength(framer, length_);
-  }
+  return OverwriteLength(framer,
+                         length_ - framer.GetControlFrameHeaderSize());
 }
 
 bool SpdyFrameBuilder::OverwriteLength(const SpdyFramer& framer,