QUIC - fix crash bug in client handling of Server Push.

net/quic/chromium/quic_http_stream.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/chromium/quic_http_stream.h"
 
 #include <utility>
 
 #include "base/auto_reset.h"
 #include "base/callback_helpers.h"
@@ skipping 256 matching lines @@
   // Store the serialized request headers.
   CreateSpdyHeadersFromHttpRequest(*request_info_, request_headers,
                                    /*direct=*/true, &request_headers_);
 
   // Store the request body.
   request_body_stream_ = request_info_->upload_data_stream;
   if (request_body_stream_) {
     // A request with a body is ineligible for push, so reset the
     // promised stream and request a new stream.
     if (found_promise_) {
-      found_promise_ = false;
       std::string url(request_info_->url.spec());
       QuicClientPromisedInfo* promised =
           session_->push_promise_index()->GetPromised(url);
       if (promised != nullptr) {
         session_->ResetPromised(promised->id(), QUIC_STREAM_CANCELLED);
       }
     }
 
     // TODO(rch): Can we be more precise about when to allocate
     // raw_request_body_buf_. Removed the following check. DoReadRequestBody()
     // was being called even if we didn't yet allocate raw_request_body_buf_.
     //   && (request_body_stream_->size() ||
     //       request_body_stream_->is_chunked()))
     // Use 10 packets as the body buffer size to give enough space to
     // help ensure we don't often send out partial packets.
     raw_request_body_buf_ =
         new IOBufferWithSize(static_cast<size_t>(10 * kMaxPacketSize));
     // The request body buffer is empty at first.
     request_body_buf_ = new DrainableIOBuffer(raw_request_body_buf_.get(), 0);
   }
 
   // Store the response info.
   response_info_ = response;
 
   int rv;
 
-  if (found_promise_) {
+  if (!found_promise_) {
+    next_state_ = STATE_SET_REQUEST_PRIORITY;
+  } else if (!request_body_stream_) {
     next_state_ = STATE_HANDLE_PROMISE;
   } else {
-    next_state_ = STATE_SET_REQUEST_PRIORITY;
+    found_promise_ = false;
+    next_state_ = STATE_REQUEST_STREAM;
   }
   rv = DoLoop(OK);
 
   if (rv == ERR_IO_PENDING)
     callback_ = callback;
 
   return rv > 0 ? OK : rv;
 }
 
 int QuicHttpStream::ReadResponseHeaders(const CompletionCallback& callback) {
@@ skipping 551 matching lines @@
   // If |response_info_| is null then the request has not been sent, so
   // return ERR_CONNECTION_CLOSED to permit HttpNetworkTransaction to
   // retry the request.
   if (!response_info_)
     return ERR_CONNECTION_CLOSED;
 
   return ERR_QUIC_PROTOCOL_ERROR;
 }
 
 }  // namespace net