Fixes use-after-free with Server Migration

net/quic/chromium/quic_stream_factory.cc

Index: net/quic/chromium/quic_stream_factory.cc
diff --git a/net/quic/chromium/quic_stream_factory.cc b/net/quic/chromium/quic_stream_factory.cc
index c1711985e4887f72c074fed495d30288e0ef9c06..223400af6099ad2146fbf735564ac8f5cf35e215 100644
--- a/net/quic/chromium/quic_stream_factory.cc
+++ b/net/quic/chromium/quic_stream_factory.cc
@@ -1262,10 +1262,14 @@ void QuicStreamFactory::OnSessionGoingAway(QuicChromiumClientSession* session) {
   }
   ProcessGoingAwaySession(session, all_sessions_[session].server_id(), false);
   if (!aliases.empty()) {
-    const IPEndPoint peer_address = session->connection()->peer_address();
+    DCHECK(base::ContainsKey(session_peer_ip_, session));
+    const IPEndPoint peer_address = session_peer_ip_[session];
     ip_aliases_[peer_address].erase(session);
     if (ip_aliases_[peer_address].empty())
       ip_aliases_.erase(peer_address);
+    session_peer_ip_.erase(session);
+    DVLOG(1) << "Deleted from ip_aliases_ map: "
+             << peer_address.address().ToString();

[Ryan Hamilton, 2016/08/25 19:29:59]

nit: I think you can remove this logging since I doubt it'll be useful later.
But feel free to keep it if you like.

[Jana, 2016/08/25 21:41:26]

Meh. I wasn't sure, but I thought it might be useful. Removed.

   }
   session_aliases_.erase(session);
 }
@@ -1877,6 +1881,8 @@ void QuicStreamFactory::ActivateSession(const QuicSessionKey& key,
   const IPEndPoint peer_address = session->connection()->peer_address();
   DCHECK(!base::ContainsKey(ip_aliases_[peer_address], session));
   ip_aliases_[peer_address].insert(session);
+  DCHECK(!base::ContainsKey(session_peer_ip_, session));
+  session_peer_ip_[session] = peer_address;
 }
 
 int64_t QuicStreamFactory::GetServerNetworkStatsSmoothedRttInMicroseconds(