Do not crash on null stream in writing to bidirectional streams

net/spdy/bidirectional_stream_spdy_impl.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/bidirectional_stream_spdy_impl.h"
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/time/time.h"
@@ skipping 42 matching lines @@
     bool /*send_request_headers_automatically*/,
     BidirectionalStreamImpl::Delegate* delegate,
     std::unique_ptr<base::Timer> timer) {
   DCHECK(!stream_);
   DCHECK(timer);
 
   delegate_ = delegate;
   timer_ = std::move(timer);
 
   if (!spdy_session_) {
-    delegate_->OnFailed(ERR_CONNECTION_CLOSED);
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE,
+        base::Bind(&BidirectionalStreamSpdyImpl::NotifyError,
+                   weak_factory_.GetWeakPtr(), ERR_CONNECTION_CLOSED));
     return;
   }
 
   request_info_ = request_info;
 
   int rv = stream_request_.StartRequest(
       SPDY_BIDIRECTIONAL_STREAM, spdy_session_, request_info_->url,
       request_info_->priority, net_log,
       base::Bind(&BidirectionalStreamSpdyImpl::OnStreamInitialized,
                  weak_factory_.GetWeakPtr()));
@@ skipping 23 matching lines @@
   // Read will complete asynchronously and Delegate::OnReadCompleted will be
   // called upon completion.
   read_buffer_ = buf;
   read_buffer_len_ = buf_len;
   return ERR_IO_PENDING;
 }
 
 void BidirectionalStreamSpdyImpl::SendData(const scoped_refptr<IOBuffer>& data,
                                            int length,
                                            bool end_stream) {
-  DCHECK(!stream_closed_);
-  DCHECK(stream_);
+  DCHECK(length > 0 || (length == 0 && end_stream));
+
+  if (!stream_) {
+    LOG(ERROR) << "Trying to send data when stream has been destroyed.";
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE, base::Bind(&BidirectionalStreamSpdyImpl::NotifyError,
+                              weak_factory_.GetWeakPtr(), ERR_UNEXPECTED));
+    return;
+  }
 
   stream_->SendData(data.get(), length,
                     end_stream ? NO_MORE_DATA_TO_SEND : MORE_DATA_TO_SEND);
 }
 
 void BidirectionalStreamSpdyImpl::SendvData(
     const std::vector<scoped_refptr<IOBuffer>>& buffers,
     const std::vector<int>& lengths,
     bool end_stream) {
-  DCHECK(!stream_closed_);
-  DCHECK(stream_);
   DCHECK_EQ(buffers.size(), lengths.size());
 
+  if (!stream_) {
+    LOG(ERROR) << "Trying to send data when stream has been destroyed.";
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE, base::Bind(&BidirectionalStreamSpdyImpl::NotifyError,
+                              weak_factory_.GetWeakPtr(), ERR_UNEXPECTED));
+    return;
+  }
+
   int total_len = 0;
   for (int len : lengths) {
     total_len += len;
   }
 
   pending_combined_buffer_ = new net::IOBuffer(total_len);
   int len = 0;
   // TODO(xunjieli): Get rid of extra copy. Coalesce headers and data frames.
   for (size_t i = 0; i < buffers.size(); ++i) {
     memcpy(pending_combined_buffer_->data() + len, buffers[i]->data(),
@@ skipping 89 matching lines @@
 void BidirectionalStreamSpdyImpl::OnClose(int status) {
   DCHECK(stream_);
 
   stream_closed_ = true;
   closed_stream_status_ = status;
   closed_stream_received_bytes_ = stream_->raw_received_bytes();
   closed_stream_sent_bytes_ = stream_->raw_sent_bytes();
   stream_.reset();
 
   if (status != OK) {
-    delegate_->OnFailed(status);
+    NotifyError(status);
     return;
   }
   // Complete any remaining read, as all data has been buffered.
   // If user has not called ReadData (i.e |read_buffer_| is nullptr), this will
   // do nothing.
   timer_->Stop();
   DoBufferedRead();
 }
 
 int BidirectionalStreamSpdyImpl::SendRequestHeadersHelper() {
@@ skipping 18 matching lines @@
     stream_ = stream_request_.ReleaseStream();
     stream_->SetDelegate(this);
     rv = SendRequestHeadersHelper();
     if (rv == OK) {
       OnRequestHeadersSent();
       return;
     } else if (rv == ERR_IO_PENDING) {
       return;
     }
   }
+  NotifyError(rv);
+}
+
+void BidirectionalStreamSpdyImpl::NotifyError(int rv) {
   delegate_->OnFailed(rv);
 }
 
 void BidirectionalStreamSpdyImpl::ScheduleBufferedRead() {
   // If there is already a scheduled DoBufferedRead, don't issue
   // another one. Mark that we have received more data and return.
   if (timer_->IsRunning()) {
     more_read_data_pending_ = true;
     return;
   }
@@ skipping 29 matching lines @@
 
 bool BidirectionalStreamSpdyImpl::ShouldWaitForMoreBufferedData() const {
   if (stream_closed_)
     return false;
   DCHECK_GT(read_buffer_len_, 0);
   return read_data_queue_.GetTotalSize() <
          static_cast<size_t>(read_buffer_len_);
 }
 
 }  // namespace net