Fix memory corruption from SetMaxPacingRate by inlining PacingSender.

net/quic/core/quic_sent_packet_manager.cc

Index: net/quic/core/quic_sent_packet_manager.cc
diff --git a/net/quic/core/quic_sent_packet_manager.cc b/net/quic/core/quic_sent_packet_manager.cc
index 5b9026de419546db081a8d3f710aac5d0c6daccd..8cd4824671ce1c72d629327bead1fc86a9db5ff8 100644
--- a/net/quic/core/quic_sent_packet_manager.cc
+++ b/net/quic/core/quic_sent_packet_manager.cc
@@ -42,9 +42,6 @@ static const int64_t kMinHandshakeTimeoutMs = 10;
 // per draft RFC draft-dukkipati-tcpm-tcp-loss-probe.
 static const size_t kDefaultMaxTailLossProbes = 2;
 
-// Number of unpaced packets to send after quiescence.
-static const size_t kInitialUnpacedBurst = 10;
-
 bool HasCryptoHandshake(const TransmissionInfo& transmission_info) {
   DCHECK(!transmission_info.has_crypto_handshake ||
          !transmission_info.retransmittable_frames.empty());
@@ -73,12 +70,6 @@ QuicSentPacketManager::QuicSentPacketManager(
       debug_delegate_(nullptr),
       network_change_visitor_(nullptr),
       initial_congestion_window_(kInitialCongestionWindow),
-      send_algorithm_(
-          SendAlgorithmInterface::Create(clock,
-                                         &rtt_stats_,
-                                         congestion_control_type,
-                                         stats,
-                                         initial_congestion_window_)),
       loss_algorithm_(&general_loss_algorithm_),
       general_loss_algorithm_(loss_type),
       n_connection_simulation_(false),
@@ -96,7 +87,9 @@ QuicSentPacketManager::QuicSentPacketManager(
       undo_pending_retransmits_(false),
       largest_newly_acked_(0),
       largest_mtu_acked_(0),
-      handshake_confirmed_(false) {}
+      handshake_confirmed_(false) {
+  SetSendAlgorithm(congestion_control_type);
+}
 
 QuicSentPacketManager::~QuicSentPacketManager() {}
 
@@ -117,26 +110,20 @@ void QuicSentPacketManager::SetFromConfig(const QuicConfig& config) {
   // TODO(ianswett): BBR is currently a server only feature.
   if (FLAGS_quic_allow_bbr && config.HasReceivedConnectionOptions() &&
       ContainsQuicTag(config.ReceivedConnectionOptions(), kTBBR)) {
-    send_algorithm_.reset(SendAlgorithmInterface::Create(
-        clock_, &rtt_stats_, kBBR, stats_, initial_congestion_window_));
+    SetSendAlgorithm(kBBR);
   }
   if (config.HasReceivedConnectionOptions() &&
       ContainsQuicTag(config.ReceivedConnectionOptions(), kRENO)) {
     if (ContainsQuicTag(config.ReceivedConnectionOptions(), kBYTE)) {
-      send_algorithm_.reset(SendAlgorithmInterface::Create(
-          clock_, &rtt_stats_, kRenoBytes, stats_, initial_congestion_window_));
+      SetSendAlgorithm(kRenoBytes);
     } else {
-      send_algorithm_.reset(SendAlgorithmInterface::Create(
-          clock_, &rtt_stats_, kReno, stats_, initial_congestion_window_));
+      SetSendAlgorithm(kReno);
     }
   } else if (config.HasReceivedConnectionOptions() &&
              ContainsQuicTag(config.ReceivedConnectionOptions(), kBYTE)) {
-    send_algorithm_.reset(SendAlgorithmInterface::Create(
-        clock_, &rtt_stats_, kCubicBytes, stats_, initial_congestion_window_));
-  }
-  if (!FLAGS_quic_disable_pacing_for_perf_tests) {
-    EnablePacing();
+    SetSendAlgorithm(kCubicBytes);
   }
+  using_pacing_ = !FLAGS_quic_disable_pacing_for_perf_tests;
 
   if (config.HasClientSentConnectionOption(k1CON, perspective_)) {
     send_algorithm_->SetNumEmulatedConnections(1);
@@ -195,10 +182,7 @@ void QuicSentPacketManager::SetNumOpenStreams(size_t num_streams) {
 }
 
 void QuicSentPacketManager::SetMaxPacingRate(QuicBandwidth max_pacing_rate) {
-  if (using_pacing_) {
-    static_cast<PacingSender*>(send_algorithm_.get())
-        ->SetMaxPacingRate(max_pacing_rate);
-  }
+  pacing_sender_.set_max_pacing_rate(max_pacing_rate);
 }
 
 void QuicSentPacketManager::SetHandshakeConfirmed() {
@@ -283,8 +267,13 @@ void QuicSentPacketManager::MaybeInvokeCongestionEvent(
   if (!rtt_updated && packets_acked_.empty() && packets_lost_.empty()) {
     return;
   }
-  send_algorithm_->OnCongestionEvent(rtt_updated, bytes_in_flight,
+  if (using_pacing_) {
+    pacing_sender_.OnCongestionEvent(rtt_updated, bytes_in_flight,
                                      packets_acked_, packets_lost_);
+  } else {
+    send_algorithm_->OnCongestionEvent(rtt_updated, bytes_in_flight,
+                                       packets_acked_, packets_lost_);
+  }
   packets_acked_.clear();
   packets_lost_.clear();
   if (network_change_visitor_ != nullptr) {
@@ -560,10 +549,16 @@ bool QuicSentPacketManager::OnPacketSent(
     --pending_timer_transmission_count_;
   }
 
-  // TODO(ianswett): Remove sent_time, because it's unused.
-  const bool in_flight = send_algorithm_->OnPacketSent(
-      sent_time, unacked_packets_.bytes_in_flight(), packet_number,
-      serialized_packet->encrypted_length, has_retransmittable_data);
+  bool in_flight;
+  if (using_pacing_) {
+    in_flight = pacing_sender_.OnPacketSent(
+        sent_time, unacked_packets_.bytes_in_flight(), packet_number,
+        serialized_packet->encrypted_length, has_retransmittable_data);
+  } else {
+    in_flight = send_algorithm_->OnPacketSent(
+        sent_time, unacked_packets_.bytes_in_flight(), packet_number,
+        serialized_packet->encrypted_length, has_retransmittable_data);
+  }
 
   unacked_packets_.AddSentPacket(serialized_packet, original_packet_number,
                                  transmission_type, sent_time, in_flight);
@@ -774,6 +769,9 @@ QuicTime::Delta QuicSentPacketManager::TimeUntilSend(QuicTime now,
   // send algorithm does not need to be consulted.
   if (pending_timer_transmission_count_ > 0) {
     delay = QuicTime::Delta::Zero();
+  } else if (using_pacing_) {
+    delay =
+        pacing_sender_.TimeUntilSend(now, unacked_packets_.bytes_in_flight());
   } else {
     delay =
         send_algorithm_->TimeUntilSend(now, unacked_packets_.bytes_in_flight());
@@ -926,19 +924,17 @@ void QuicSentPacketManager::CancelRetransmissionsForStream(
   }
 }
 
-void QuicSentPacketManager::EnablePacing() {
-  // TODO(ianswett): Replace with a method which wraps the send algorithm in a
-  // pacer every time a new algorithm is set.
-  if (using_pacing_) {
-    return;
-  }
+void QuicSentPacketManager::SetSendAlgorithm(
+    CongestionControlType congestion_control_type) {
+  SetSendAlgorithm(SendAlgorithmInterface::Create(
+      clock_, &rtt_stats_, congestion_control_type, stats_,
+      initial_congestion_window_));
+}
 
-  // Set up a pacing sender with a 1 millisecond alarm granularity, the same as
-  // the default granularity of the Linux kernel's FQ qdisc.
-  using_pacing_ = true;
-  send_algorithm_.reset(new PacingSender(send_algorithm_.release(),
-                                         QuicTime::Delta::FromMilliseconds(1),
-                                         kInitialUnpacedBurst));
+void QuicSentPacketManager::SetSendAlgorithm(
+    SendAlgorithmInterface* send_algorithm) {
+  send_algorithm_.reset(send_algorithm);
+  pacing_sender_.set_sender(send_algorithm);
 }
 
 void QuicSentPacketManager::OnConnectionMigration(QuicPathId,