Do not use SpdyFrameBuilder::OverwriteLength().

net/spdy/spdy_frame_builder.cc

Index: net/spdy/spdy_frame_builder.cc
diff --git a/net/spdy/spdy_frame_builder.cc b/net/spdy/spdy_frame_builder.cc
index 5f14f78ab3e18a8bd3590e3539f4445fbe7b643c..39f0c29606e9c8d7550559bcf3ce21e800869bab 100644
--- a/net/spdy/spdy_frame_builder.cc
+++ b/net/spdy/spdy_frame_builder.cc
@@ -65,6 +65,29 @@ bool SpdyFrameBuilder::BeginNewFrame(const SpdyFramer& framer,
   return success;
 }
 
+bool SpdyFrameBuilder::BeginNewFrame(const SpdyFramer& framer,
+                                     SpdyFrameType type,
+                                     uint8_t flags,
+                                     SpdyStreamId stream_id,
+                                     size_t length) {
+  DCHECK(IsValidFrameType(SerializeFrameType(type)));
+  DCHECK_EQ(0u, stream_id & ~kStreamIdMask);
+  bool success = true;
+  SPDY_BUG_IF(framer.GetFrameMaximumSize() < length_)
+      << "Frame length  " << length_
+      << " is longer than the maximum allowed length.";
+
+  offset_ += length_;
+  length_ = 0;
+
+  success &= WriteUInt24(length);
+  success &= WriteUInt8(SerializeFrameType(type));
+  success &= WriteUInt8(flags);
+  success &= WriteUInt32(stream_id);
+  DCHECK_EQ(framer.GetDataFrameMinimumSize(), length_);
+  return success;
+}
+
 bool SpdyFrameBuilder::WriteStringPiece16(const base::StringPiece& value) {
   if (value.size() > 0xffff) {
     DCHECK(false) << "Tried to write string with length > 16bit.";