Fix potential crash bug with BidirectionalStreamQuicImpl::SendRequestHeaders

net/quic/chromium/bidirectional_stream_quic_impl.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_QUIC_CHROMIUM_BIDIRECTIONAL_STREAM_QUIC_IMPL_H_
 #define NET_QUIC_CHROMIUM_BIDIRECTIONAL_STREAM_QUIC_IMPL_H_
 
 #include <stdint.h>
 
 #include <memory>
@@ skipping 43 matching lines @@
   NextProto GetProtocol() const override;
   int64_t GetTotalReceivedBytes() const override;
   int64_t GetTotalSentBytes() const override;
   bool GetLoadTimingInfo(LoadTimingInfo* load_timing_info) const override;
 
  private:
   // QuicChromiumClientStream::Delegate implementation:
   void OnClose() override;
   void OnError(int error) override;
 
+  bool WriteHeaders();
   void OnStreamReady(int rv);
   void OnSendDataComplete(int rv);
   void ReadInitialHeaders();
   void OnReadInitialHeadersComplete(int rv);
   void ReadTrailingHeaders();
   void OnReadTrailingHeadersComplete(int rv);
   void OnReadDataComplete(int rv);
 
-  // Notifies the delegate of an error.
+  // Notifies the delegate of an error, clears |stream_| and |delegate_|,
+  // and cancels any pending callbacks.
   void NotifyError(int error);
+  // Notifies the delegate of an error, clears |stream_| and |delegate_|,
+  // and cancels any pending callbacks. If |notify_delegate_later| is true
+  // then the delegate will be notified asynchronously via a posted task,
+  // otherwise the notification will be synchronous.
+  void NotifyErrorImpl(int error, bool notify_delegate_later);
   // Notifies the delegate that the stream is ready.
   void NotifyStreamReady();
   // Resets the stream and ensures that |delegate_| won't be called back.
   void ResetStream();
+  // Invokes OnFailure(error) on |delegate|.
+  void NotifyFailure(BidirectionalStreamImpl::Delegate* delegate, int error);
 
   const std::unique_ptr<QuicChromiumClientSession::Handle> session_;
   std::unique_ptr<QuicChromiumClientStream::Handle> stream_;
 
   const BidirectionalStreamRequestInfo* request_info_;
   BidirectionalStreamImpl::Delegate* delegate_;
   // Saves the response status if the stream is explicitly closed via OnError
   // or OnClose with an error. Once all buffered data has been returned, this
   // will be used as the final response.
   int response_status_;
@@ skipping 35 matching lines @@
   bool send_request_headers_automatically_;
 
   base::WeakPtrFactory<BidirectionalStreamQuicImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(BidirectionalStreamQuicImpl);
 };
 
 }  // namespace net
 
 #endif  // NET_QUIC_CHROMIUM_BIDIRECTIONAL_STREAM_QUIC_IMPL_H_