Fix memory corruption from SetMaxPacingRate by inlining PacingSender.

net/quic/core/quic_sent_packet_manager.h

Index: net/quic/core/quic_sent_packet_manager.h
diff --git a/net/quic/core/quic_sent_packet_manager.h b/net/quic/core/quic_sent_packet_manager.h
index 0333e98336fae13f026ac95b826cdd532c104705..17e22034042f8ae888df89592601453d1512b424 100644
--- a/net/quic/core/quic_sent_packet_manager.h
+++ b/net/quic/core/quic_sent_packet_manager.h
@@ -17,6 +17,7 @@
 #include "net/base/linked_hash_map.h"
 #include "net/quic/core/congestion_control/general_loss_algorithm.h"
 #include "net/quic/core/congestion_control/loss_detection_interface.h"
+#include "net/quic/core/congestion_control/pacing_sender.h"
 #include "net/quic/core/congestion_control/rtt_stats.h"
 #include "net/quic/core/congestion_control/send_algorithm_interface.h"
 #include "net/quic/core/quic_protocol.h"
@@ -316,8 +317,14 @@ class NET_EXPORT_PRIVATE QuicSentPacketManager
   // RTT measurement purposes.
   void RemoveObsoletePackets();
 
-  // Enables pacing if it has not already been enabled.
-  void EnablePacing();
+  // Sets the send algorithm to the given congestion control type and points the
+  // pacing sender at |send_algorithm_|. Can be called any number of times.
+  void SetSendAlgorithm(CongestionControlType congestion_control_type);
+
+  // Sets the send algorithm to |send_algorithm| and points the pacing sender at
+  // |send_algorithm_|. Takes ownership of |send_algorithm|. Can be called any
+  // number of times.
+  void SetSendAlgorithm(SendAlgorithmInterface* send_algorithm);
 
   // Newly serialized retransmittable packets are added to this map, which
   // contains owning pointers to any contained frames.  If a packet is
@@ -390,6 +397,10 @@ class NET_EXPORT_PRIVATE QuicSentPacketManager
   // Largest packet in bytes ever acknowledged.
   QuicPacketLength largest_mtu_acked_;
 
+  // Replaces certain calls to |send_algorithm_| when |using_pacing_| is true.
+  // Calls into |send_algorithm_| for the underlying congestion control.
+  PacingSender pacing_sender_;
+
   // Set to true after the crypto handshake has successfully completed. After
   // this is true we no longer use HANDSHAKE_MODE, and further frames sent on
   // the crypto stream (i.e. SCUP messages) are treated like normal