QUIC - fix crash bug in client handling of Server Push.

net/quic/chromium/quic_http_stream.cc

Index: net/quic/chromium/quic_http_stream.cc
diff --git a/net/quic/chromium/quic_http_stream.cc b/net/quic/chromium/quic_http_stream.cc
index 3b031b93f7ce6d1d9a74d68f82965c9f39d87734..91690e0865398a63aa0555e8a0b4097fe8a03fa9 100644
--- a/net/quic/chromium/quic_http_stream.cc
+++ b/net/quic/chromium/quic_http_stream.cc
@@ -274,7 +274,6 @@ int QuicHttpStream::SendRequest(const HttpRequestHeaders& request_headers,
     // A request with a body is ineligible for push, so reset the
     // promised stream and request a new stream.
     if (found_promise_) {
-      found_promise_ = false;
       std::string url(request_info_->url.spec());
       QuicClientPromisedInfo* promised =
           session_->push_promise_index()->GetPromised(url);
@@ -302,7 +301,12 @@ int QuicHttpStream::SendRequest(const HttpRequestHeaders& request_headers,
   int rv;
 
   if (found_promise_) {
-    next_state_ = STATE_HANDLE_PROMISE;
+    if (!request_body_stream_) {
+      next_state_ = STATE_HANDLE_PROMISE;
+    } else {
+      found_promise_ = false;
+      next_state_ = STATE_REQUEST_STREAM;
+    }
   } else {
     next_state_ = STATE_SET_REQUEST_PRIORITY;

[Ryan Hamilton, 2017/04/06 19:46:48]

nit: to reduce the nesting, can you do:

if (!found_promise_) {
  next_state_ = STATE_SET_REQUEST_PRIORITY;
} else if (!request_body_stream_) {
  next_state_ = STATE_HANDLE_PROMISE;
} else {
  found_promise_ = false;
  next_state_ = STATE_REQUEST_STREAM;
}

[Buck, 2017/04/06 19:59:55]

Done.

   }