Do not use SpdyFrameBuilder::OverwriteLength().

net/spdy/spdy_frame_builder.h

Index: net/spdy/spdy_frame_builder.h
diff --git a/net/spdy/spdy_frame_builder.h b/net/spdy/spdy_frame_builder.h
index 743e0f3b426f47abc7eedc97d9d248d733f9a4e8..b48ef20261d41f937838c2554cda80ec29d7756f 100644
--- a/net/spdy/spdy_frame_builder.h
+++ b/net/spdy/spdy_frame_builder.h
@@ -58,6 +58,14 @@ class NET_EXPORT_PRIVATE SpdyFrameBuilder {
                      uint8_t flags,
                      SpdyStreamId stream_id);
 
+  // Populates this frame with a HTTP2 frame prefix with length information.
+  // The given type must be a control frame type.
+  bool BeginNewFrame(const SpdyFramer& framer,
+                     SpdyFrameType type,
+                     uint8_t flags,
+                     SpdyStreamId stream_id,
+                     size_t length);
+
   // Takes the buffer from the SpdyFrameBuilder.
   SpdySerializedFrame take() {
     SPDY_BUG_IF(kMaxFrameSizeLimit < length_)