Do not invoke QuicHttpStream::DoCallback when in DoLoop

net/quic/quic_http_stream.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_http_stream.h"
 
 #include <utility>
 
 #include "base/auto_reset.h"
 #include "base/callback_helpers.h"
@@ skipping 492 matching lines @@
   if (stream_->connection_error() != QUIC_NO_ERROR ||
       stream_->stream_error() != QUIC_STREAM_NO_ERROR) {
     response_status_ = was_handshake_confirmed_ ? ERR_QUIC_PROTOCOL_ERROR
                                                 : ERR_QUIC_HANDSHAKE_FAILED;
   } else if (!response_headers_received_) {
     response_status_ = ERR_ABORTED;
   }
 
   quic_connection_error_ = stream_->connection_error();
   ResetStream();
+  if (in_loop_) {
+    // If already in DoLoop(), |callback_| will be handled when DoLoop() exits.
+    return;
+  }

[Ryan Hamilton, 2016/07/21 22:29:33]

Do you know what state in DoLoop we're in when this happens?

[xunjieli, 2016/07/22 13:21:22]

According to the crash log on crbug/629043, we are in DoSendBody().

   if (!callback_.is_null()) {
     DoCallback(response_status_);
   }
 }
 
 void QuicHttpStream::OnError(int error) {
   ResetStream();
   response_status_ =
       was_handshake_confirmed_ ? error : ERR_QUIC_HANDSHAKE_FAILED;
   if (!callback_.is_null())
@@ skipping 300 matching lines @@
   closed_stream_sent_bytes_ = stream_->stream_bytes_written();
   stream_ = nullptr;
 
   // If |request_body_stream_| is non-NULL, Reset it, to abort any in progress
   // read.
   if (request_body_stream_)
     request_body_stream_->Reset();
 }
 
 }  // namespace net