SPDY & HPACK: Land recent internal changes (through 65328503)

net/spdy/spdy_framer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// TODO(rtenhove) clean up frame buffer size calculations so that we aren't
-// constantly adding and subtracting header sizes; this is ugly and error-
-// prone.
-
 #include "net/spdy/spdy_framer.h"
 
 #include "base/lazy_instance.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/stats_counters.h"
 #include "base/third_party/valgrind/memcheck.h"
 #include "net/spdy/spdy_frame_builder.h"
 #include "net/spdy/spdy_frame_reader.h"
 #include "net/spdy/spdy_bitmasks.h"
 #include "third_party/zlib/zlib.h"
@@ skipping 54 matching lines @@
 #else
 #define CHANGE_STATE(newstate)                                  \
   do {                                                          \
     DCHECK(state_ != SPDY_ERROR);                               \
     DCHECK_EQ(previous_state_, state_);                         \
     previous_state_ = state_;                                   \
     state_ = newstate;                                          \
   } while (false)
 #endif
 
-SettingsFlagsAndId SettingsFlagsAndId::FromWireFormat(int version,
-                                                      uint32 wire) {
-  if (version < 3) {
+SettingsFlagsAndId SettingsFlagsAndId::FromWireFormat(
+    SpdyMajorVersion version, uint32 wire) {
+  if (version < SPDY3) {
     ConvertFlagsAndIdForSpdy2(&wire);
   }
   return SettingsFlagsAndId(ntohl(wire) >> 24, ntohl(wire) & 0x00ffffff);
 }
 
 SettingsFlagsAndId::SettingsFlagsAndId(uint8 flags, uint32 id)
     : flags_(flags), id_(id & 0x00ffffff) {
   LOG_IF(DFATAL, id > (1u << 24)) << "SPDY setting ID too large: " << id;
 }
 
-uint32 SettingsFlagsAndId::GetWireFormat(int version) const {
+uint32 SettingsFlagsAndId::GetWireFormat(SpdyMajorVersion version)
+    const {
   uint32 wire = htonl(id_ & 0x00ffffff) | htonl(flags_ << 24);
-  if (version < 3) {
+  if (version < SPDY3) {
     ConvertFlagsAndIdForSpdy2(&wire);
   }
   return wire;
 }
 
 // SPDY 2 had a bug in it with respect to byte ordering of id/flags field.
 // This method is used to preserve buggy behavior and works on both
 // little-endian and big-endian hosts.
 // This method is also bidirectional (can be used to translate SPDY 2 to SPDY 3
 // as well as vice versa).
@@ skipping 10 matching lines @@
 
 bool SpdyFramerVisitorInterface::OnRstStreamFrameData(
     const char* rst_stream_data,
     size_t len) {
   return true;
 }
 
 SpdyFramer::SpdyFramer(SpdyMajorVersion version)
     : current_frame_buffer_(new char[kControlFrameBufferSize]),
       enable_compression_(true),
+      hpack_encoder_(ObtainHpackHuffmanTable()),
       hpack_decoder_(ObtainHpackHuffmanTable()),
       visitor_(NULL),
       debug_visitor_(NULL),
       display_protocol_("SPDY"),
       spdy_version_(version),
       syn_frame_processed_(false),
       probable_http_response_(false),
       expect_continuation_(0),
       end_stream_when_done_(false) {
   DCHECK_GE(spdy_version_, SPDY_MIN_VERSION);
@@ skipping 20 matching lines @@
   current_frame_type_ = DATA;
   current_frame_flags_ = 0;
   current_frame_length_ = 0;
   current_frame_stream_id_ = kInvalidStream;
   settings_scratch_.Reset();
   remaining_padding_payload_length_ = 0;
   remaining_padding_length_fields_ = 0;
 }
 
 size_t SpdyFramer::GetDataFrameMinimumSize() const {
-  // Size, in bytes, of the data frame header. Future versions of SPDY
-  // will likely vary this, so we allow for the flexibility of a function call
-  // for this value as opposed to a constant.
-  return 8;
+  return SpdyConstants::GetDataFrameMinimumSize();
 }
 
 // Size, in bytes, of the control frame header.
 size_t SpdyFramer::GetControlFrameHeaderSize() const {
-  switch (protocol_version()) {
-    case SPDY2:
-    case SPDY3:
-    case SPDY4:
-      return 8;
-  }
-  LOG(DFATAL) << "Unhandled SPDY version.";
-  return 0;
+  return SpdyConstants::GetControlFrameHeaderSize(protocol_version());
 }
 
 size_t SpdyFramer::GetSynStreamMinimumSize() const {
   // Size, in bytes, of a SYN_STREAM frame not including the variable-length
   // name-value block.
   if (protocol_version() <= SPDY3) {
     // Calculated as:
     // control frame header + 2 * 4 (stream IDs) + 1 (priority)
     // + 1 (unused, was credential slot)
     return GetControlFrameHeaderSize() + 10;
@@ skipping 61 matching lines @@
 
 size_t SpdyFramer::GetGoAwayMinimumSize() const {
   // Size, in bytes, of this GOAWAY frame. Calculated as:
   // 1. Control frame header size
   size_t size = GetControlFrameHeaderSize();
 
   // 2. Last good stream id (4 bytes)
   size += 4;
 
   // 3. SPDY 3+ GOAWAY frames also contain a status (4 bytes)
-  if (protocol_version() >= 3) {
+  if (protocol_version() >= SPDY3) {
     size += 4;
   }
 
   return size;
 }
 
 size_t SpdyFramer::GetHeadersMinimumSize() const  {
   // Size, in bytes, of a HEADERS frame not including the variable-length
   // name-value block.
   size_t size = GetControlFrameHeaderSize();
@@ skipping 18 matching lines @@
     // control frame header + 4 (stream id) + 4 (delta)
     return GetControlFrameHeaderSize() + 8;
   } else {
     // Calculated as:
     // frame prefix + 4 (delta)
     return GetControlFrameHeaderSize() + 4;
   }
 }
 
 size_t SpdyFramer::GetBlockedSize() const {
-  DCHECK_LE(4, protocol_version());
+  DCHECK_LT(SPDY3, protocol_version());
   // Size, in bytes, of a BLOCKED frame.
   // The BLOCKED frame has no payload beyond the control frame header.
   return GetControlFrameHeaderSize();
 }
 
 size_t SpdyFramer::GetPushPromiseMinimumSize() const {
-  DCHECK_LE(4, protocol_version());
+  DCHECK_LT(SPDY3, protocol_version());
   // Size, in bytes, of a PUSH_PROMISE frame, sans the embedded header block.
   // Calculated as frame prefix + 4 (promised stream id).
   return GetControlFrameHeaderSize() + 4;
 }
 
 size_t SpdyFramer::GetContinuationMinimumSize() const  {
   // Size, in bytes, of a CONTINUATION frame not including the variable-length
   // headers fragments.
   return GetControlFrameHeaderSize();
 }
 
 size_t SpdyFramer::GetFrameMinimumSize() const {
   return std::min(GetDataFrameMinimumSize(), GetControlFrameHeaderSize());
 }
 
 size_t SpdyFramer::GetFrameMaximumSize() const {
-  if (protocol_version() <= SPDY3) {
-    // 24-bit length field plus eight-byte frame header.
-    return ((1<<24) - 1) + 8;
-  } else {
-    // 14-bit length field.
-    return (1<<14) - 1;
-  }
+  return SpdyConstants::GetFrameMaximumSize(protocol_version());
 }
 
 size_t SpdyFramer::GetDataFrameMaximumPayload() const {
   return GetFrameMaximumSize() - GetDataFrameMinimumSize();
 }
 
+size_t SpdyFramer::GetPrefixLength(SpdyFrameType type) const {
+  return SpdyConstants::GetPrefixLength(type, protocol_version());
+}
+
 const char* SpdyFramer::StateToString(int state) {
   switch (state) {
     case SPDY_ERROR:
       return "ERROR";
     case SPDY_AUTO_RESET:
       return "AUTO_RESET";
     case SPDY_RESET:
       return "RESET";
     case SPDY_READING_COMMON_HEADER:
       return "READING_COMMON_HEADER";
@@ skipping 79 matching lines @@
     case RST_STREAM_FLOW_CONTROL_ERROR:
       return "FLOW_CONTROL_ERROR";
     case RST_STREAM_STREAM_IN_USE:
       return "STREAM_IN_USE";
     case RST_STREAM_STREAM_ALREADY_CLOSED:
       return "STREAM_ALREADY_CLOSED";
     case RST_STREAM_INVALID_CREDENTIALS:
       return "INVALID_CREDENTIALS";
     case RST_STREAM_FRAME_TOO_LARGE:
       return "FRAME_TOO_LARGE";
+    case RST_STREAM_CONNECT_ERROR:
+      return "CONNECT_ERROR";
+    case RST_STREAM_ENHANCE_YOUR_CALM:
+      return "ENHANCE_YOUR_CALM";
   }
   return "UNKNOWN_STATUS";
 }
 
 const char* SpdyFramer::FrameTypeToString(SpdyFrameType type) {
   switch (type) {
     case DATA:
       return "DATA";
     case SYN_STREAM:
       return "SYN_STREAM";
@@ skipping 114 matching lines @@
         break;
       }
 
       case SPDY_CONSUME_PADDING: {
         size_t bytes_read = ProcessFramePadding(data, len);
         len -= bytes_read;
         data += bytes_read;
         break;
       }
 
-      case SPDY_IGNORE_REMAINING_PAYLOAD:
-        // control frame has too-large payload
-        // intentional fallthrough
+      case SPDY_IGNORE_REMAINING_PAYLOAD: {
+        size_t bytes_read = ProcessIgnoredControlFramePayload(/*data,*/ len);
+        len -= bytes_read;
+        data += bytes_read;
+        break;
+      }
+
       case SPDY_FORWARD_STREAM_FRAME: {
         size_t bytes_read = ProcessDataFramePayload(data, len);
         len -= bytes_read;
         data += bytes_read;
         break;
       }
+
       default:
         LOG(DFATAL) << "Invalid value for " << display_protocol_
                     << " framer state: " << state_;
         // This ensures that we don't infinite-loop if state_ gets an
         // invalid value somehow, such as due to a SpdyFramer getting deleted
         // from a callback it calls.
         goto bottom;
     }
   } while (state_ != previous_state_);
  bottom:
@@ skipping 38 matching lines @@
 
   uint16 control_frame_type_field = DATA;
   // ProcessControlFrameHeader() will set current_frame_type_ to the
   // correct value if this is a valid control frame.
   current_frame_type_ = DATA;
   if (protocol_version() <= SPDY3) {
     bool successful_read = reader->ReadUInt16(&version);
     DCHECK(successful_read);
     is_control_frame = (version & kControlFlagMask) != 0;
     version &= ~kControlFlagMask;  // Only valid for control frames.
-
     if (is_control_frame) {
+      // We check version before we check validity: version can never be
+      // 'invalid', it can only be unsupported.
+      if (version < SpdyConstants::SerializeMajorVersion(SPDY_MIN_VERSION) ||
+          version > SpdyConstants::SerializeMajorVersion(SPDY_MAX_VERSION) ||
+          SpdyConstants::ParseMajorVersion(version) != protocol_version()) {
+        // Version does not match the version the framer was initialized with.
+        DVLOG(1) << "Unsupported SPDY version "
+                 << version
+                 << " (expected " << protocol_version() << ")";
+        set_error(SPDY_UNSUPPORTED_VERSION);
+        return 0;
+      } else {
+        // Convert version from wire format to SpdyMajorVersion.
+        version = SpdyConstants::ParseMajorVersion(version);
+      }
       // We check control_frame_type_field's validity in
       // ProcessControlFrameHeader().
       successful_read = reader->ReadUInt16(&control_frame_type_field);
     } else {
       reader->Rewind();
       successful_read = reader->ReadUInt31(&current_frame_stream_id_);
     }
     DCHECK(successful_read);
 
     successful_read = reader->ReadUInt8(&current_frame_flags_);
@@ skipping 95 matching lines @@
         CHANGE_STATE(SPDY_READ_PADDING_LENGTH);
       } else {
         // Empty data frame.
         if (current_frame_flags_ & DATA_FLAG_FIN) {
           visitor_->OnStreamFrameData(
               current_frame_stream_id_, NULL, 0, true);
         }
         CHANGE_STATE(SPDY_AUTO_RESET);
       }
     }
-  } else if (version != protocol_version()) {
-    // We check version before we check validity: version can never be
-    // 'invalid', it can only be unsupported.
-    DVLOG(1) << "Unsupported SPDY version " << version
-             << " (expected " << protocol_version() << ")";
-    set_error(SPDY_UNSUPPORTED_VERSION);
   } else {
     ProcessControlFrameHeader(control_frame_type_field);
   }
 
   return original_len - len;
 }
 
 void SpdyFramer::ProcessControlFrameHeader(uint16 control_frame_type_field) {
   DCHECK_EQ(SPDY_NO_ERROR, error_code_);
   DCHECK_LE(GetControlFrameHeaderSize(), current_frame_buffer_length_);
@@ skipping 145 matching lines @@
       if (current_frame_length_ < GetPushPromiseMinimumSize()) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (protocol_version() <= SPDY3 && current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       } else if (protocol_version() > SPDY3 && current_frame_flags_ &
                  ~PUSH_PROMISE_FLAG_END_PUSH_PROMISE) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case CONTINUATION:
-      if (current_frame_length_ < GetContinuationMinimumSize()) {
+      if (current_frame_length_ < GetContinuationMinimumSize() ||
+          protocol_version() <= SPDY3) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (current_frame_flags_ & ~HEADERS_FLAG_END_HEADERS) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     default:
       LOG(WARNING) << "Valid " << display_protocol_
                    << " control frame with unhandled type: "
                    << current_frame_type_;
       // This branch should be unreachable because of the frame type bounds
@@ skipping 95 matching lines @@
     memcpy(current_frame_buffer_.get() + current_frame_buffer_length_,
            *data,
            bytes_to_read);
     current_frame_buffer_length_ += bytes_to_read;
     *data += bytes_to_read;
     *len -= bytes_to_read;
   }
   return bytes_to_read;
 }
 
-size_t SpdyFramer::GetSerializedLength(const int spdy_version,
-                                       const SpdyHeaderBlock* headers) {
+size_t SpdyFramer::GetSerializedLength(
+    const SpdyMajorVersion spdy_version,
+    const SpdyHeaderBlock* headers) {
   const size_t num_name_value_pairs_size
-      = (spdy_version < 3) ? sizeof(uint16) : sizeof(uint32);
+      = (spdy_version < SPDY3) ? sizeof(uint16) : sizeof(uint32);
   const size_t length_of_name_size = num_name_value_pairs_size;
   const size_t length_of_value_size = num_name_value_pairs_size;
 
   size_t total_length = num_name_value_pairs_size;
   for (SpdyHeaderBlock::const_iterator it = headers->begin();
        it != headers->end();
        ++it) {
     // We add space for the length of the name and the length of the value as
     // well as the length of the name and the length of the value.
     total_length += length_of_name_size + it->first.size() +
                     length_of_value_size + it->second.size();
   }
   return total_length;
 }
 
 void SpdyFramer::WriteHeaderBlock(SpdyFrameBuilder* frame,
-                                  const int spdy_version,
+                                  const SpdyMajorVersion spdy_version,
                                   const SpdyHeaderBlock* headers) {
-  if (spdy_version < 3) {
+  if (spdy_version < SPDY3) {
     frame->WriteUInt16(headers->size());  // Number of headers.
   } else {
     frame->WriteUInt32(headers->size());  // Number of headers.
   }
   SpdyHeaderBlock::const_iterator it;
   for (it = headers->begin(); it != headers->end(); ++it) {
-    if (spdy_version < 3) {
+    if (spdy_version < SPDY3) {
       frame->WriteString(it->first);
       frame->WriteString(it->second);
     } else {
       frame->WriteStringPiece32(it->first);
       frame->WriteStringPiece32(it->second);
     }
   }
 }
 
 // TODO(phajdan.jr): Clean up after we no longer need
@@ skipping 504 matching lines @@
   DCHECK_LT(SPDY3, protocol_version());
   DCHECK_EQ(0u, remaining_data_length_);
 
   const SpdyNameValueBlock& block = hpack_decoder_.decoded_block();
   if (block.empty()) {
     // Special-case this to make tests happy.
     ProcessControlFrameHeaderBlock(NULL, 0, false);
     return;
   }
   SpdyFrameBuilder builder(
-      GetSerializedLength(protocol_version(), &block));
+      GetSerializedLength(protocol_version(), &block),
+      SPDY3);
 
   SerializeNameValueBlockWithoutCompression(&builder, block);
   scoped_ptr<SpdyFrame> frame(builder.take());
 
   remaining_data_length_ = frame->size();
   ProcessControlFrameHeaderBlock(frame->data(), frame->size(), false);
 }
 
 bool SpdyFramer::ProcessSetting(const char* data) {
   int id_field;
@@ skipping 132 matching lines @@
       reader.Seek(GetControlFrameHeaderSize());  // Seek past frame header.
       bool successful_read = reader.ReadUInt31(&current_frame_stream_id_);
       DCHECK(successful_read);
 
       // In SPDYv3 and up, frames also specify a status code - parse it out.
       SpdyGoAwayStatus status = GOAWAY_OK;
       if (protocol_version() >= SPDY3) {
         uint32 status_raw = GOAWAY_OK;
         successful_read = reader.ReadUInt32(&status_raw);
         DCHECK(successful_read);
-        // We've read an unsigned integer, so it's enough to only check
-        // upper bound to ensure the value is in valid range.
-        if (status_raw < GOAWAY_NUM_STATUS_CODES) {
-          status = static_cast<SpdyGoAwayStatus>(status_raw);
+        if (SpdyConstants::IsValidGoAwayStatus(protocol_version(),
+                                               status_raw)) {
+          status = SpdyConstants::ParseGoAwayStatus(protocol_version(),
+                                                    status_raw);
         } else {
-          // TODO(hkhalil): Probably best to OnError here, depending on
-          // our interpretation of the spec. Keeping with existing liberal
-          // behavior for now.
           DCHECK(false);
+          // Throw an error for SPDY4+, keep liberal behavior
+          // for earlier versions.
+          if (protocol_version() > SPDY3) {
+            DLOG(WARNING) << "Invalid GO_AWAY status " << status_raw;
+            set_error(SPDY_INVALID_CONTROL_FRAME);
+            return 0;
+          }
         }
       }
       // Finished parsing the GOAWAY header, call frame handler.
       visitor_->OnGoAway(current_frame_stream_id_, status);
     }
   }
 
   // Handle remaining data as opaque.
   bool processed_successfully = true;
   if (len > 0) {
@@ skipping 37 matching lines @@
       reader.Seek(GetControlFrameHeaderSize());  // Seek past frame header.
       if (protocol_version() <= SPDY3) {
         bool successful_read = reader.ReadUInt31(&current_frame_stream_id_);
         DCHECK(successful_read);
       }
 
       SpdyRstStreamStatus status = RST_STREAM_INVALID;
       uint32 status_raw = status;
       bool successful_read = reader.ReadUInt32(&status_raw);
       DCHECK(successful_read);
-      // We've read an unsigned integer, so it's enough to only check
-      // upper bound to ensure the value is in valid range.
-      if (status_raw > RST_STREAM_INVALID &&
-          status_raw < RST_STREAM_NUM_STATUS_CODES) {
+      if (SpdyConstants::IsValidRstStreamStatus(protocol_version(),
+                                                status_raw)) {
         status = static_cast<SpdyRstStreamStatus>(status_raw);
       } else {
-        // TODO(hkhalil): Probably best to OnError here, depending on
-        // our interpretation of the spec. Keeping with existing liberal
-        // behavior for now.
+        // Throw an error for SPDY4+, keep liberal behavior
+        // for earlier versions.
+        if (protocol_version() > SPDY3) {
+          DLOG(WARNING) << "Invalid RST_STREAM status " << status_raw;
+          set_error(SPDY_INVALID_CONTROL_FRAME);
+          return 0;
+        }
       }
       // Finished parsing the RST_STREAM header, call frame handler.
       visitor_->OnRstStream(current_frame_stream_id_, status);
     }
   }
 
   // Handle remaining data as opaque.
   bool processed_successfully = true;
   if (len > 0) {
     processed_successfully = visitor_->OnRstStreamFrameData(data, len);
@@ skipping 10 matching lines @@
 }
 
 size_t SpdyFramer::ProcessFramePaddingLength(const char* data, size_t len) {
   DCHECK_EQ(SPDY_READ_PADDING_LENGTH, state_);
 
   size_t original_len = len;
   if (remaining_padding_length_fields_ == 0) {
     DCHECK_EQ(remaining_padding_payload_length_, 0u);
     bool pad_low = false;
     bool pad_high = false;
-    if (current_frame_flags_ & net::DATA_FLAG_PAD_LOW) {
+    if (current_frame_flags_ & DATA_FLAG_PAD_LOW) {
       pad_low = true;
       ++remaining_padding_length_fields_;
     }
-    if (current_frame_flags_ & net::DATA_FLAG_PAD_HIGH) {
+    if (current_frame_flags_ & DATA_FLAG_PAD_HIGH) {
       pad_high = true;
       ++remaining_padding_length_fields_;
     }
     if ((pad_high && !pad_low) ||
         remaining_data_length_ < remaining_padding_length_fields_) {
       set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
       return 0;
     }
   }
 
@@ skipping 29 matching lines @@
     // Communicate the padding to the visitor through a NULL data pointer, with
     // a nonzero size.
     if (amount_to_discard) {
       visitor_->OnStreamFrameData(
           current_frame_stream_id_, NULL, amount_to_discard, false);
     }
     data += amount_to_discard;
     len -= amount_to_discard;
     remaining_padding_payload_length_ -= amount_to_discard;
     remaining_data_length_ -= amount_to_discard;
-
-    // If the FIN flag is set, and there is no more data in this data
-    // frame, inform the visitor of EOF via a 0-length data frame.
-    if (!remaining_data_length_ && current_frame_flags_ & DATA_FLAG_FIN) {
-      visitor_->OnStreamFrameData(current_frame_stream_id_, NULL, 0, true);
-    }
   }
 
   if (remaining_data_length_ == 0) {
+    // If the FIN flag is set, and there is no more data in this data frame,
+    // inform the visitor of EOF via a 0-length data frame.
+    if (current_frame_flags_ & DATA_FLAG_FIN) {
+      visitor_->OnStreamFrameData(current_frame_stream_id_, NULL, 0, true);
+    }
+
     CHANGE_STATE(SPDY_AUTO_RESET);
   }
   return original_len - len;
 }
 
 size_t SpdyFramer::ProcessDataFramePayload(const char* data, size_t len) {
   size_t original_len = len;
   if (remaining_data_length_ - remaining_padding_payload_length_ > 0) {
     size_t amount_to_forward = std::min(
         remaining_data_length_ - remaining_padding_payload_length_, len);
     if (amount_to_forward && state_ != SPDY_IGNORE_REMAINING_PAYLOAD) {
       // Only inform the visitor if there is data.
       if (amount_to_forward) {
         visitor_->OnStreamFrameData(
             current_frame_stream_id_, data, amount_to_forward, false);
       }
     }
     data += amount_to_forward;
     len -= amount_to_forward;
     remaining_data_length_ -= amount_to_forward;
-
-    // If the FIN flag is set, and there is no more data in this data
-    // frame, inform the visitor of EOF via a 0-length data frame.
-    if (!remaining_data_length_ && current_frame_flags_ & DATA_FLAG_FIN) {
-      visitor_->OnStreamFrameData(current_frame_stream_id_, NULL, 0, true);
-    }
   }
 
   if (remaining_data_length_ == remaining_padding_payload_length_) {
     CHANGE_STATE(SPDY_CONSUME_PADDING);
   }
   return original_len - len;
 }
 
+size_t SpdyFramer::ProcessIgnoredControlFramePayload(/*const char* data,*/
+                                                     size_t len) {
+  size_t original_len = len;
+  if (remaining_data_length_ > 0) {
+    size_t amount_to_ignore = std::min(remaining_data_length_, len);
+    len -= amount_to_ignore;
+    remaining_data_length_ -= amount_to_ignore;
+  }
+
+  if (remaining_data_length_ == 0) {
+    CHANGE_STATE(SPDY_AUTO_RESET);
+  }
+  return original_len - len;
+}
+
 size_t SpdyFramer::ParseHeaderBlockInBuffer(const char* header_data,
                                           size_t header_length,
                                           SpdyHeaderBlock* block) const {
   SpdyFrameReader reader(header_data, header_length);
 
   // Read number of headers.
   uint32 num_headers;
   if (protocol_version() <= SPDY2) {
     uint16 temp;
     if (!reader.ReadUInt16(&temp)) {
@@ skipping 36 matching lines @@
                << num_headers << ").";
       return 0;
     }
 
     // Store header.
     (*block)[name] = value;
   }
   return reader.GetBytesConsumed();
 }
 
-SpdySerializedFrame* SpdyFramer::SerializeData(const SpdyDataIR& datair) const {
+SpdySerializedFrame* SpdyFramer::SerializeData(
+    const SpdyDataIR& data_ir) const {
   uint8 flags = DATA_FLAG_NONE;
-  if (datair.fin()) {
+  if (data_ir.fin()) {
     flags = DATA_FLAG_FIN;
   }
 
   if (protocol_version() > SPDY3) {
     int num_padding_fields = 0;
-    if (datair.pad_low()) {
+    if (data_ir.pad_low()) {
       flags |= DATA_FLAG_PAD_LOW;
       ++num_padding_fields;
     }
-    if (datair.pad_high()) {
+    if (data_ir.pad_high()) {
       flags |= DATA_FLAG_PAD_HIGH;
       ++num_padding_fields;
     }
 
     const size_t size_with_padding = num_padding_fields +
-        datair.data().length() + datair.padding_payload_len() +
+        data_ir.data().length() + data_ir.padding_payload_len() +
         GetDataFrameMinimumSize();
-    SpdyFrameBuilder builder(size_with_padding);
-    builder.WriteDataFrameHeader(*this, datair.stream_id(), flags);
-    if (datair.pad_high()) {
-      builder.WriteUInt8(datair.padding_payload_len() >> 8);
+    SpdyFrameBuilder builder(size_with_padding, protocol_version());
+    builder.WriteDataFrameHeader(*this, data_ir.stream_id(), flags);
+    if (data_ir.pad_high()) {
+      builder.WriteUInt8(data_ir.padding_payload_len() >> 8);
     }
-    if (datair.pad_low()) {
-      builder.WriteUInt8(datair.padding_payload_len() & 0xff);
+    if (data_ir.pad_low()) {
+      builder.WriteUInt8(data_ir.padding_payload_len() & 0xff);
     }
-    builder.WriteBytes(datair.data().data(), datair.data().length());
-    if (datair.padding_payload_len() > 0) {
-      string padding = string(datair.padding_payload_len(), '0');
+    builder.WriteBytes(data_ir.data().data(), data_ir.data().length());
+    if (data_ir.padding_payload_len() > 0) {
+      string padding = string(data_ir.padding_payload_len(), '0');
       builder.WriteBytes(padding.data(), padding.length());
     }
     DCHECK_EQ(size_with_padding, builder.length());
     return builder.take();
   } else {
-    const size_t size = GetDataFrameMinimumSize() + datair.data().length();
-    SpdyFrameBuilder builder(size);
-    builder.WriteDataFrameHeader(*this, datair.stream_id(), flags);
-    builder.WriteBytes(datair.data().data(), datair.data().length());
+    const size_t size = GetDataFrameMinimumSize() + data_ir.data().length();
+    SpdyFrameBuilder builder(size, protocol_version());
+    builder.WriteDataFrameHeader(*this, data_ir.stream_id(), flags);
+    builder.WriteBytes(data_ir.data().data(), data_ir.data().length());
     DCHECK_EQ(size, builder.length());
     return builder.take();
   }
 }
 
-SpdySerializedFrame* SpdyFramer::SerializeDataFrameHeader(
-    const SpdyDataIR& data) const {
-  const size_t kSize = GetDataFrameMinimumSize();
-
+SpdySerializedFrame* SpdyFramer::SerializeDataFrameHeaderWithPaddingLengthField(
+    const SpdyDataIR& data_ir) const {
   uint8 flags = DATA_FLAG_NONE;
-  if (data.fin()) {
+  if (data_ir.fin()) {
     flags = DATA_FLAG_FIN;
   }
+
+  size_t frame_size = GetDataFrameMinimumSize();
+  size_t num_padding_fields = 0;
   if (protocol_version() > SPDY3) {
-    if (data.pad_low()) {
+    if (data_ir.pad_low()) {
       flags |= DATA_FLAG_PAD_LOW;
+      ++num_padding_fields;
     }
-    if (data.pad_high()) {
+    if (data_ir.pad_high()) {
       flags |= DATA_FLAG_PAD_HIGH;
+      ++num_padding_fields;
     }
+    frame_size += num_padding_fields;
   }
 
-  SpdyFrameBuilder builder(kSize);
-  builder.WriteDataFrameHeader(*this, data.stream_id(), flags);
-  builder.OverwriteLength(*this, data.data().length());
-  DCHECK_EQ(kSize, builder.length());
+  SpdyFrameBuilder builder(frame_size, protocol_version());
+  builder.WriteDataFrameHeader(*this, data_ir.stream_id(), flags);
+  if (protocol_version() > SPDY3) {
+    if (data_ir.pad_high()) {
+      builder.WriteUInt8(data_ir.padding_payload_len() >> 8);
+    }
+    if (data_ir.pad_low()) {
+      builder.WriteUInt8(data_ir.padding_payload_len() & 0xff);
+    }
+    builder.OverwriteLength(*this,  num_padding_fields +
+        data_ir.data().length() + data_ir.padding_payload_len());
+  } else {
+    builder.OverwriteLength(*this, data_ir.data().length());
+  }
+  DCHECK_EQ(frame_size, builder.length());
   return builder.take();
 }
 
 SpdySerializedFrame* SpdyFramer::SerializeSynStream(
     const SpdySynStreamIR& syn_stream) {
   uint8 flags = 0;
   if (syn_stream.fin()) {
     flags |= CONTROL_FLAG_FIN;
   }
   if (syn_stream.unidirectional()) {
@@ skipping 12 matching lines @@
   if (priority > GetLowestPriority()) {
     DLOG(DFATAL) << "Priority out-of-bounds.";
     priority = GetLowestPriority();
   }
 
   // The size of this frame, including variable-length name-value block.
   size_t size = GetSynStreamMinimumSize();
 
   string hpack_encoding;
   if (protocol_version() > SPDY3) {
-    hpack_encoder_.EncodeHeaderSet(syn_stream.name_value_block(),
-                                   &hpack_encoding);
+    if (enable_compression_) {
+      hpack_encoder_.EncodeHeaderSet(
+          syn_stream.name_value_block(), &hpack_encoding);
+    } else {
+      hpack_encoder_.EncodeHeaderSetWithoutCompression(
+          syn_stream.name_value_block(), &hpack_encoding);
+    }
     size += hpack_encoding.size();
   } else {
     size += GetSerializedLength(syn_stream.name_value_block());
   }
 
-  SpdyFrameBuilder builder(size);
+  SpdyFrameBuilder builder(size, protocol_version());
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, SYN_STREAM, flags);
     builder.WriteUInt32(syn_stream.stream_id());
     builder.WriteUInt32(syn_stream.associated_to_stream_id());
     builder.WriteUInt8(priority << ((protocol_version() <= SPDY2) ? 6 : 5));
     builder.WriteUInt8(0);  // Unused byte where credential slot used to be.
   } else {
-    builder.WriteFramePrefix(*this,
-                             HEADERS,
-                             flags,
-                             syn_stream.stream_id());
+    builder.BeginNewFrame(*this,
+                          HEADERS,
+                          flags,
+                          syn_stream.stream_id());
     builder.WriteUInt32(priority);
   }
   DCHECK_EQ(GetSynStreamMinimumSize(), builder.length());
   if (protocol_version() > SPDY3) {
     builder.WriteBytes(&hpack_encoding[0], hpack_encoding.size());
   } else {
     SerializeNameValueBlock(&builder, syn_stream);
   }
 
   if (debug_visitor_) {
@@ skipping 21 matching lines @@
   // we never expect to have to overflow into a CONTINUATION frame.
   if (protocol_version() > SPDY3) {
     flags |= HEADERS_FLAG_END_HEADERS;
   }
 
   // The size of this frame, including variable-length name-value block.
   size_t size = GetSynReplyMinimumSize();
 
   string hpack_encoding;
   if (protocol_version() > SPDY3) {
-    hpack_encoder_.EncodeHeaderSet(syn_reply.name_value_block(),
-                                   &hpack_encoding);
+    if (enable_compression_) {
+      hpack_encoder_.EncodeHeaderSet(
+          syn_reply.name_value_block(), &hpack_encoding);
+    } else {
+      hpack_encoder_.EncodeHeaderSetWithoutCompression(
+          syn_reply.name_value_block(), &hpack_encoding);
+    }
     size += hpack_encoding.size();
   } else {
     size += GetSerializedLength(syn_reply.name_value_block());
   }
 
-  SpdyFrameBuilder builder(size);
+  SpdyFrameBuilder builder(size, protocol_version());
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, SYN_REPLY, flags);
     builder.WriteUInt32(syn_reply.stream_id());
   } else {
-    builder.WriteFramePrefix(*this,
-                             HEADERS,
-                             flags,
-                             syn_reply.stream_id());
+    builder.BeginNewFrame(*this,
+                          HEADERS,
+                          flags,
+                          syn_reply.stream_id());
   }
   if (protocol_version() < SPDY3) {
     builder.WriteUInt16(0);  // Unused.
   }
   DCHECK_EQ(GetSynReplyMinimumSize(), builder.length());
   if (protocol_version() > SPDY3) {
     builder.WriteBytes(&hpack_encoding[0], hpack_encoding.size());
   } else {
     SerializeNameValueBlock(&builder, syn_reply);
   }
@@ skipping 16 matching lines @@
     const SpdyRstStreamIR& rst_stream) const {
   // TODO(jgraettinger): For now, Chromium will support parsing RST_STREAM
   // payloads, but will not emit them. SPDY4 is used for draft HTTP/2,
   // which doesn't currently include RST_STREAM payloads. GFE flags have been
   // commented but left in place to simplify future patching.
   // Compute the output buffer size, taking opaque data into account.
   uint16 expected_length = GetRstStreamMinimumSize();
   if (protocol_version() > SPDY3) {
     expected_length += rst_stream.description().size();
   }
-  SpdyFrameBuilder builder(expected_length);
+  SpdyFrameBuilder builder(expected_length, protocol_version());
 
   // Serialize the RST_STREAM frame.
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, RST_STREAM, 0);
     builder.WriteUInt32(rst_stream.stream_id());
   } else {
-    builder.WriteFramePrefix(*this, RST_STREAM, 0, rst_stream.stream_id());
+    builder.BeginNewFrame(*this, RST_STREAM, 0, rst_stream.stream_id());
   }
 
   builder.WriteUInt32(rst_stream.status());
 
   // In SPDY4 and up, RST_STREAM frames may also specify opaque data.
   if (protocol_version() > SPDY3 && rst_stream.description().size() > 0) {
     builder.WriteBytes(rst_stream.description().data(),
                        rst_stream.description().size());
   }
 
@@ skipping 13 matching lines @@
     if (settings.is_ack()) {
       flags |= SETTINGS_FLAG_ACK;
     }
   }
   const SpdySettingsIR::ValueMap* values = &(settings.values());
 
   size_t setting_size = (protocol_version() <= SPDY3 ? 8 : 5);
   // Size, in bytes, of this SETTINGS frame.
   const size_t size = GetSettingsMinimumSize() +
                       (values->size() * setting_size);
-  SpdyFrameBuilder builder(size);
+  SpdyFrameBuilder builder(size, protocol_version());
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, SETTINGS, flags);
   } else {
-    builder.WriteFramePrefix(*this, SETTINGS, flags, 0);
+    builder.BeginNewFrame(*this, SETTINGS, flags, 0);
   }
 
   // If this is an ACK, payload should be empty.
   if (protocol_version() > SPDY3 && settings.is_ack()) {
     return builder.take();
   }
 
   if (protocol_version() <= SPDY3) {
     builder.WriteUInt32(values->size());
   }
@@ skipping 17 matching lines @@
     } else {
       builder.WriteUInt8(SpdyConstants::SerializeSettingId(protocol_version(),
                                                            it->first));
     }
     builder.WriteUInt32(it->second.value);
   }
   DCHECK_EQ(size, builder.length());
   return builder.take();
 }
 
-SpdyFrame* SpdyFramer::SerializeBlocked(const SpdyBlockedIR& blocked) const {
-  DCHECK_LT(SPDY3, protocol_version());
-  SpdyFrameBuilder builder(GetBlockedSize());
-  builder.WriteFramePrefix(*this, BLOCKED, kNoFlags, blocked.stream_id());
-  return builder.take();
-}
-
 SpdySerializedFrame* SpdyFramer::SerializePing(const SpdyPingIR& ping) const {
-  SpdyFrameBuilder builder(GetPingSize());
+  SpdyFrameBuilder builder(GetPingSize(), protocol_version());
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, PING, kNoFlags);
     builder.WriteUInt32(static_cast<uint32>(ping.id()));
   } else {
     uint8 flags = 0;
     if (ping.is_ack()) {
       flags |= PING_FLAG_ACK;
     }
-    builder.WriteFramePrefix(*this, PING, flags, 0);
+    builder.BeginNewFrame(*this, PING, flags, 0);
     builder.WriteUInt64(ping.id());
   }
   DCHECK_EQ(GetPingSize(), builder.length());
   return builder.take();
 }
 
 SpdySerializedFrame* SpdyFramer::SerializeGoAway(
     const SpdyGoAwayIR& goaway) const {
 
   // Compute the output buffer size, take opaque data into account.
   uint16 expected_length = GetGoAwayMinimumSize();
   if (protocol_version() > SPDY3) {
     expected_length += goaway.description().size();
   }
-  SpdyFrameBuilder builder(expected_length);
+  SpdyFrameBuilder builder(expected_length, protocol_version());
 
   // Serialize the GOAWAY frame.
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, GOAWAY, kNoFlags);
   } else {
-    builder.WriteFramePrefix(*this, GOAWAY, 0, 0);
+    builder.BeginNewFrame(*this, GOAWAY, 0, 0);
   }
 
   // GOAWAY frames specify the last good stream id for all SPDY versions.
   builder.WriteUInt32(goaway.last_good_stream_id());
 
   // In SPDY3 and up, GOAWAY frames also specify the error status code.
   if (protocol_version() >= SPDY3) {
     builder.WriteUInt32(goaway.status());
   }
 
   // In SPDY4 and up, GOAWAY frames may also specify opaque data.
   if ((protocol_version() > SPDY3) && (goaway.description().size() > 0)) {
     builder.WriteBytes(goaway.description().data(),
                        goaway.description().size());
   }
 
   DCHECK_EQ(expected_length, builder.length());
   return builder.take();
 }
 
 SpdySerializedFrame* SpdyFramer::SerializeHeaders(
     const SpdyHeadersIR& headers) {
   uint8 flags = 0;
   if (headers.fin()) {
     flags |= CONTROL_FLAG_FIN;
   }
   if (protocol_version() > SPDY3) {
+    // TODO(mlavan): If we overflow into a CONTINUATION frame, this will
+    // get overwritten below, so we should probably just get rid of the
+    // end_headers field.
     if (headers.end_headers()) {
       flags |= HEADERS_FLAG_END_HEADERS;
     }
     if (headers.has_priority()) {
       flags |= HEADERS_FLAG_PRIORITY;
     }
   }
 
   // The size of this frame, including variable-length name-value block.
   size_t size = GetHeadersMinimumSize();
 
   uint32 priority = headers.priority();
   if (headers.has_priority()) {
     if (priority > GetLowestPriority()) {
       DLOG(DFATAL) << "Priority out-of-bounds.";
       priority = GetLowestPriority();
     }
     size += 4;
   }
 
   string hpack_encoding;
   if (protocol_version() > SPDY3) {
-    hpack_encoder_.EncodeHeaderSet(headers.name_value_block(), &hpack_encoding);
+    if (enable_compression_) {
+      hpack_encoder_.EncodeHeaderSet(
+          headers.name_value_block(), &hpack_encoding);
+    } else {
+      hpack_encoder_.EncodeHeaderSetWithoutCompression(
+          headers.name_value_block(), &hpack_encoding);
+    }
     size += hpack_encoding.size();
+    if (size > GetControlFrameBufferMaxSize()) {
+      size += GetNumberRequiredContinuationFrames(size) *
+              GetContinuationMinimumSize();
+      flags &= ~HEADERS_FLAG_END_HEADERS;
+    }
   } else {
     size += GetSerializedLength(headers.name_value_block());
   }
 
-  SpdyFrameBuilder builder(size);
+  SpdyFrameBuilder builder(size, protocol_version());
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, HEADERS, flags);
     builder.WriteUInt32(headers.stream_id());
   } else {
-    builder.WriteFramePrefix(*this,
-                             HEADERS,
-                             flags,
-                             headers.stream_id());
+    builder.BeginNewFrame(*this,
+                          HEADERS,
+                          flags,
+                          headers.stream_id());
     if (headers.has_priority()) {
       builder.WriteUInt32(priority);
     }
   }
   if (protocol_version() <= SPDY2) {
     builder.WriteUInt16(0);  // Unused.
   }
   DCHECK_EQ(GetHeadersMinimumSize(), builder.length());
 
   if (protocol_version() > SPDY3) {
-    builder.WriteBytes(&hpack_encoding[0], hpack_encoding.size());
+    WritePayloadWithContinuation(&builder,
+                                 hpack_encoding,
+                                 headers.stream_id(),
+                                 HEADERS);
   } else {
     SerializeNameValueBlock(&builder, headers);
   }
 
   if (debug_visitor_) {
     const size_t payload_len = protocol_version() > SPDY3 ?
         hpack_encoding.size() :
         GetSerializedLength(protocol_version(),
                             &(headers.name_value_block()));
     debug_visitor_->OnSendCompressedFrame(headers.stream_id(),
                                           HEADERS,
                                           payload_len,
                                           builder.length());
   }
 
   return builder.take();
 }
 
 SpdySerializedFrame* SpdyFramer::SerializeWindowUpdate(
     const SpdyWindowUpdateIR& window_update) const {
-  SpdyFrameBuilder builder(GetWindowUpdateSize());
+  SpdyFrameBuilder builder(GetWindowUpdateSize(), protocol_version());
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, WINDOW_UPDATE, kNoFlags);
     builder.WriteUInt32(window_update.stream_id());
   } else {
-    builder.WriteFramePrefix(*this,
-                             WINDOW_UPDATE,
-                             kNoFlags,
-                             window_update.stream_id());
+    builder.BeginNewFrame(*this,
+                          WINDOW_UPDATE,
+                          kNoFlags,
+                          window_update.stream_id());
   }
   builder.WriteUInt32(window_update.delta());
   DCHECK_EQ(GetWindowUpdateSize(), builder.length());
   return builder.take();
 }
 
+SpdyFrame* SpdyFramer::SerializeBlocked(const SpdyBlockedIR& blocked) const {
+  DCHECK_LT(SPDY3, protocol_version());
+  SpdyFrameBuilder builder(GetBlockedSize(), protocol_version());
+  builder.BeginNewFrame(*this, BLOCKED, kNoFlags, blocked.stream_id());
+  return builder.take();
+}
+
 SpdyFrame* SpdyFramer::SerializePushPromise(
     const SpdyPushPromiseIR& push_promise) {
   DCHECK_LT(SPDY3, protocol_version());
   uint8 flags = 0;
+  // TODO(mlavan): If we overflow into a CONTINUATION frame, this will
+  // get overwritten below, so we should probably just get rid of the
+  // end_push_promise field.
   if (push_promise.end_push_promise()) {
     flags |= PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
   }
   // The size of this frame, including variable-length name-value block.
   size_t size = GetPushPromiseMinimumSize();
 
   string hpack_encoding;
   if (protocol_version() > SPDY3) {
-    hpack_encoder_.EncodeHeaderSet(push_promise.name_value_block(),
-                                   &hpack_encoding);
+    if (enable_compression_) {
+      hpack_encoder_.EncodeHeaderSet(
+          push_promise.name_value_block(), &hpack_encoding);
+    } else {
+      hpack_encoder_.EncodeHeaderSetWithoutCompression(
+          push_promise.name_value_block(), &hpack_encoding);
+    }
     size += hpack_encoding.size();
+    if (size > GetControlFrameBufferMaxSize()) {
+      size += GetNumberRequiredContinuationFrames(size) *
+              GetContinuationMinimumSize();
+      flags &= ~PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
+    }
   } else {
     size += GetSerializedLength(push_promise.name_value_block());
   }
 
-  SpdyFrameBuilder builder(size);
-  builder.WriteFramePrefix(*this, PUSH_PROMISE, flags,
-      push_promise.stream_id());
+  SpdyFrameBuilder builder(size, protocol_version());
+  builder.BeginNewFrame(*this,
+                        PUSH_PROMISE,
+                        flags,
+                        push_promise.stream_id());
   builder.WriteUInt32(push_promise.promised_stream_id());
   DCHECK_EQ(GetPushPromiseMinimumSize(), builder.length());
 
   if (protocol_version() > SPDY3) {
-    builder.WriteBytes(&hpack_encoding[0], hpack_encoding.size());
+    WritePayloadWithContinuation(&builder,
+                                 hpack_encoding,
+                                 push_promise.stream_id(),
+                                 PUSH_PROMISE);
   } else {
     SerializeNameValueBlock(&builder, push_promise);
   }
 
   if (debug_visitor_) {
     const size_t payload_len = protocol_version() > SPDY3 ?
         hpack_encoding.size() :
         GetSerializedLength(protocol_version(),
                             &(push_promise.name_value_block()));
     debug_visitor_->OnSendCompressedFrame(push_promise.stream_id(),
@@ skipping 10 matching lines @@
     const SpdyContinuationIR& continuation) {
   CHECK_LT(SPDY3, protocol_version());
   uint8 flags = 0;
   if (continuation.end_headers()) {
     flags |= HEADERS_FLAG_END_HEADERS;
   }
 
   // The size of this frame, including variable-length name-value block.
   size_t size = GetContinuationMinimumSize();
   string hpack_encoding;
-  hpack_encoder_.EncodeHeaderSet(continuation.name_value_block(),
-                                 &hpack_encoding);
+  if (enable_compression_) {
+    hpack_encoder_.EncodeHeaderSet(
+        continuation.name_value_block(), &hpack_encoding);
+  } else {
+    hpack_encoder_.EncodeHeaderSetWithoutCompression(
+        continuation.name_value_block(), &hpack_encoding);
+  }
   size += hpack_encoding.size();
 
-  SpdyFrameBuilder builder(size);
-  builder.WriteFramePrefix(*this, CONTINUATION, flags,
+  SpdyFrameBuilder builder(size, protocol_version());
+  builder.BeginNewFrame(*this, CONTINUATION, flags,
       continuation.stream_id());
   DCHECK_EQ(GetContinuationMinimumSize(), builder.length());
 
   builder.WriteBytes(&hpack_encoding[0], hpack_encoding.size());
 
   if (debug_visitor_) {
     const size_t payload_len = hpack_encoding.size();
     debug_visitor_->OnSendCompressedFrame(continuation.stream_id(),
         CONTINUATION, payload_len, builder.length());
   }
@@ skipping 69 matching lines @@
     GetSerializedLength(protocol_version(), &headers);
   if (!enable_compression_) {
     return uncompressed_length;
   }
   z_stream* compressor = GetHeaderCompressor();
   // Since we'll be performing lots of flushes when compressing the data,
   // zlib's lower bounds may be insufficient.
   return 2 * deflateBound(compressor, uncompressed_length);
 }
 
+size_t SpdyFramer::GetNumberRequiredContinuationFrames(size_t size) {
+  const size_t kMaxControlFrameSize = GetControlFrameBufferMaxSize();
+  DCHECK_GT(protocol_version(), SPDY3);
+  DCHECK_GT(size, kMaxControlFrameSize);
+  size_t overflow = size - kMaxControlFrameSize;
+  return overflow / (kMaxControlFrameSize - GetContinuationMinimumSize()) + 1;
+}
+
+void SpdyFramer::WritePayloadWithContinuation(SpdyFrameBuilder* builder,
+                                              const string& hpack_encoding,
+                                              SpdyStreamId stream_id,
+                                              SpdyFrameType type) {
+  const size_t kMaxControlFrameSize = GetControlFrameBufferMaxSize();
+
+    // In addition to the prefix, fixed_field_size includes the size of
+    // any fields that come before the variable-length name/value block.
+    size_t fixed_field_size = 0;
+    uint8 end_flag = 0;
+    uint8 flags = 0;
+    if (type == HEADERS) {
+      fixed_field_size = GetHeadersMinimumSize();
+      end_flag = HEADERS_FLAG_END_HEADERS;
+    } else if (type == PUSH_PROMISE) {
+      fixed_field_size = GetPushPromiseMinimumSize();
+      end_flag = PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
+    } else {
+      DLOG(FATAL) << "CONTINUATION frames cannot be used with frame type "
+                  << FrameTypeToString(type);
+    }
+
+    // Write as much of the payload as possible into the initial frame.
+    size_t bytes_remaining = hpack_encoding.size() -
+        std::min(hpack_encoding.size(),
+                 kMaxControlFrameSize - fixed_field_size);
+    builder->WriteBytes(&hpack_encoding[0],
+                        hpack_encoding.size() - bytes_remaining);
+
+    if (bytes_remaining > 0) {
+      builder->OverwriteLength(*this,
+          kMaxControlFrameSize - GetControlFrameHeaderSize());
+    }
+
+    // Tack on CONTINUATION frames for the overflow.
+    while (bytes_remaining > 0) {
+      size_t bytes_to_write = std::min(bytes_remaining,
+                                       kMaxControlFrameSize -
+                                       GetContinuationMinimumSize());
+      // Write CONTINUATION frame prefix.
+      if (bytes_remaining == bytes_to_write) {
+        flags |= end_flag;
+      }
+      builder->BeginNewFrame(*this,
+                             CONTINUATION,
+                             flags,
+                             stream_id);
+      // Write payload fragment.
+      builder->WriteBytes(&hpack_encoding[hpack_encoding.size() -
+                                          bytes_remaining],
+                          bytes_to_write);
+      bytes_remaining -= bytes_to_write;
+    }
+}
+
 // The following compression setting are based on Brian Olson's analysis. See
 // https://groups.google.com/group/spdy-dev/browse_thread/thread/dfaf498542fac792
 // for more details.
 #if defined(USE_SYSTEM_ZLIB)
 // System zlib is not expected to have workaround for http://crbug.com/139744,
 // so disable compression in that case.
 // TODO(phajdan.jr): Remove the special case when it's no longer necessary.
 static const int kCompressorLevel = 0;
 #else  // !defined(USE_SYSTEM_ZLIB)
 static const int kCompressorLevel = 9;
@@ skipping 167 matching lines @@
     const SpdyFrameWithNameValueBlockIR& frame) {
   CHECK_GE(SPDY3, protocol_version());
   if (!enable_compression_) {
     return SerializeNameValueBlockWithoutCompression(builder,
                                                      frame.name_value_block());
   }
 
   // First build an uncompressed version to be fed into the compressor.
   const size_t uncompressed_len = GetSerializedLength(
       protocol_version(), &(frame.name_value_block()));
-  SpdyFrameBuilder uncompressed_builder(uncompressed_len);
+  SpdyFrameBuilder uncompressed_builder(uncompressed_len, protocol_version());
   SerializeNameValueBlockWithoutCompression(&uncompressed_builder,
                                             frame.name_value_block());
   scoped_ptr<SpdyFrame> uncompressed_payload(uncompressed_builder.take());
 
   z_stream* compressor = GetHeaderCompressor();
   if (!compressor) {
     LOG(DFATAL) << "Could not obtain compressor.";
     return;
   }
 
@@ skipping 38 matching lines @@
   builder->Seek(compressed_size);
   builder->RewriteLength(*this);
 
   pre_compress_bytes.Add(uncompressed_len);
   post_compress_bytes.Add(compressed_size);
 
   compressed_frames.Increment();
 }
 
 }  // namespace net