Fix a potential infinite loop in HttpStreamFactoryImpl when a new SpdySession is established

net/http/http_stream_factory_impl.cc

Index: net/http/http_stream_factory_impl.cc
diff --git a/net/http/http_stream_factory_impl.cc b/net/http/http_stream_factory_impl.cc
index bfd8303bc3f29cc8126b87411fe8168bacf42380..2fdfd4f22e7a00acb2631c8cf61f6eaafa0dcfc1 100644
--- a/net/http/http_stream_factory_impl.cc
+++ b/net/http/http_stream_factory_impl.cc
@@ -250,10 +250,12 @@ void HttpStreamFactoryImpl::OnNewSpdySessionReady(
     // TODO(willchan): If it's important, switch RequestSet out for a FIFO
     // queue (Order by priority first, then FIFO within same priority). Unclear
     // that it matters here.
-    if (!base::ContainsKey(spdy_session_request_map_, spdy_session_key))
+    auto iter = spdy_session_request_map_.find(spdy_session_key);
+    if (iter == spdy_session_request_map_.end())
       break;
-    Request* request = *spdy_session_request_map_[spdy_session_key].begin();
+    Request* request = *iter->second.begin();
     request->Complete(was_alpn_negotiated, negotiated_protocol, using_spdy);
+    RemoveRequestFromSpdySessionRequestMap(request);
     if (for_websockets_) {
       // TODO(ricea): Restore this code path when WebSocket over SPDY
       // implementation is ready.
@@ -413,4 +415,19 @@ void HttpStreamFactoryImpl::DumpMemoryStats(
                           preconnect_controller_count);
 }
 
+void HttpStreamFactoryImpl::RemoveRequestFromSpdySessionRequestMap(
+    Request* request) {
+  const SpdySessionKey* spdy_session_key = request->spdy_session_key();
+  if (!spdy_session_key)
+    return;
+  auto iter = spdy_session_request_map_.find(*spdy_session_key);
+  if (iter == spdy_session_request_map_.end())
+    return;
+  RequestSet& request_set = iter->second;
+  // erase() is no-op if |request| isn't contained in |request_set|.
+  request_set.erase(request);
+  if (request_set.empty())
+    spdy_session_request_map_.erase(iter);
+}
+
 }  // namespace net