Land recent SPDY changes (through 70021377)

net/spdy/spdy_framer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_framer.h"
 
 #include "base/lazy_instance.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/stats_counters.h"
 #include "base/third_party/valgrind/memcheck.h"
@@ skipping 148 matching lines @@
   remaining_data_length_ = 0;
   remaining_control_header_ = 0;
   current_frame_buffer_length_ = 0;
   current_frame_type_ = DATA;
   current_frame_flags_ = 0;
   current_frame_length_ = 0;
   current_frame_stream_id_ = kInvalidStream;
   settings_scratch_.Reset();
   altsvc_scratch_.Reset();
   remaining_padding_payload_length_ = 0;
-  remaining_padding_length_fields_ = 0;
 }
 
 size_t SpdyFramer::GetDataFrameMinimumSize() const {
   return SpdyConstants::GetDataFrameMinimumSize();
 }
 
 // Size, in bytes, of the control frame header.
 size_t SpdyFramer::GetControlFrameHeaderSize() const {
   return SpdyConstants::GetControlFrameHeaderSize(protocol_version());
 }
@@ skipping 282 matching lines @@
     case DATA:
       return "DATA";
     case SYN_STREAM:
       return "SYN_STREAM";
     case SYN_REPLY:
       return "SYN_REPLY";
     case RST_STREAM:
       return "RST_STREAM";
     case SETTINGS:
       return "SETTINGS";
-    case NOOP:
-      return "NOOP";
     case PING:
       return "PING";
     case GOAWAY:
       return "GOAWAY";
     case HEADERS:
       return "HEADERS";
     case WINDOW_UPDATE:
       return "WINDOW_UPDATE";
     case CREDENTIAL:
       return "CREDENTIAL";
@@ skipping 170 matching lines @@
 
   // Using a scoped_ptr here since we may need to create a new SpdyFrameReader
   // when processing DATA frames below.
   scoped_ptr<SpdyFrameReader> reader(
       new SpdyFrameReader(current_frame_buffer_.get(),
                           current_frame_buffer_length_));
 
   uint16 version = 0;
   bool is_control_frame = false;
 
-  uint16 control_frame_type_field = DATA;
+  uint16 control_frame_type_field =
+    SpdyConstants::DataFrameType(protocol_version());
   // ProcessControlFrameHeader() will set current_frame_type_ to the
   // correct value if this is a valid control frame.
   current_frame_type_ = DATA;
   if (protocol_version() <= SPDY3) {
     bool successful_read = reader->ReadUInt16(&version);
     DCHECK(successful_read);
     is_control_frame = (version & kControlFlagMask) != 0;
     version &= ~kControlFlagMask;  // Only valid for control frames.
     if (is_control_frame) {
       // We check version before we check validity: version can never be
@@ skipping 27 matching lines @@
     successful_read = reader->ReadUInt24(&length_field);
     DCHECK(successful_read);
     remaining_data_length_ = length_field;
     current_frame_length_ = remaining_data_length_ + reader->GetBytesConsumed();
   } else {
     version = protocol_version();
     uint16 length_field = 0;
     bool successful_read = reader->ReadUInt16(&length_field);
     DCHECK(successful_read);
 
-    uint8 control_frame_type_field_uint8 = DATA;
+    uint8 control_frame_type_field_uint8 =
+      SpdyConstants::DataFrameType(protocol_version());
     successful_read = reader->ReadUInt8(&control_frame_type_field_uint8);
     DCHECK(successful_read);
     // We check control_frame_type_field's validity in
     // ProcessControlFrameHeader().
     control_frame_type_field = control_frame_type_field_uint8;
-    is_control_frame = (control_frame_type_field != DATA);
+    is_control_frame = (protocol_version() > SPDY3) ?
+        control_frame_type_field !=
+            SpdyConstants::SerializeFrameType(protocol_version(), DATA) :
+        control_frame_type_field != 0;
 
     if (is_control_frame) {
       current_frame_length_ = length_field + GetControlFrameHeaderSize();
     } else {
       current_frame_length_ = length_field + GetDataFrameMinimumSize();
     }
 
     successful_read = reader->ReadUInt8(&current_frame_flags_);
     DCHECK(successful_read);
 
@@ skipping 42 matching lines @@
   // if we're here, then we have the common header all received.
   if (!is_control_frame) {
     if (protocol_version() > SPDY3) {
       // Catch bogus tests sending oversized DATA frames.
       DCHECK_GE(GetFrameMaximumSize(), current_frame_length_)
           << "DATA frame too large for SPDY >= 4.";
     }
 
     uint8 valid_data_flags = 0;
     if (protocol_version() > SPDY3) {
-      valid_data_flags = DATA_FLAG_FIN | DATA_FLAG_END_SEGMENT |
-          DATA_FLAG_PAD_LOW | DATA_FLAG_PAD_HIGH;
+      valid_data_flags =
+          DATA_FLAG_FIN | DATA_FLAG_END_SEGMENT | DATA_FLAG_PADDED;
     } else {
       valid_data_flags = DATA_FLAG_FIN;
     }
 
     if (current_frame_flags_ & ~valid_data_flags) {
       set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
     } else {
       visitor_->OnDataFrameHeader(current_frame_stream_id_,
                                   remaining_data_length_,
                                   current_frame_flags_ & DATA_FLAG_FIN);
@@ skipping 12 matching lines @@
     ProcessControlFrameHeader(control_frame_type_field);
   }
 
   return original_len - len;
 }
 
 void SpdyFramer::ProcessControlFrameHeader(uint16 control_frame_type_field) {
   DCHECK_EQ(SPDY_NO_ERROR, error_code_);
   DCHECK_LE(GetControlFrameHeaderSize(), current_frame_buffer_length_);
 
+  // TODO(mlavan): Either remove credential frames from the code entirely,
+  // or add them to parsing + serialization methods for SPDY3.
   // Early detection of deprecated frames that we ignore.
   if (protocol_version() <= SPDY3) {
-    if (control_frame_type_field == NOOP) {
-      current_frame_type_ = NOOP;
-      DVLOG(1) << "NOOP control frame found. Ignoring.";
-      CHANGE_STATE(SPDY_AUTO_RESET);
-      return;
-    }
 
     if (control_frame_type_field == CREDENTIAL) {
       current_frame_type_ = CREDENTIAL;
       DCHECK_EQ(SPDY3, protocol_version());
       DVLOG(1) << "CREDENTIAL control frame found. Ignoring.";
       CHANGE_STATE(SPDY_IGNORE_REMAINING_PAYLOAD);
       return;
     }
   }
 
@@ skipping 37 matching lines @@
       } else if (current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case SETTINGS:
     {
       // Make sure that we have an integral number of 8-byte key/value pairs,
       // plus a 4-byte length field in SPDY3 and below.
       size_t values_prefix_size = (protocol_version() <= SPDY3 ? 4 : 0);
       // Size of each key/value pair in bytes.
-      size_t setting_size = (protocol_version() <= SPDY3 ? 8 : 5);
+      size_t setting_size = SpdyConstants::GetSettingSize(protocol_version());
       if (current_frame_length_ < GetSettingsMinimumSize() ||
           (current_frame_length_ - GetControlFrameHeaderSize())
           % setting_size != values_prefix_size) {
         DLOG(WARNING) << "Invalid length for SETTINGS frame: "
                       << current_frame_length_;
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (protocol_version() <= SPDY3 &&
                  current_frame_flags_ &
                  ~SETTINGS_FLAG_CLEAR_PREVIOUSLY_PERSISTED_SETTINGS) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
@@ skipping 40 matching lines @@
         }
         if (current_frame_length_ < min_size) {
           set_error(SPDY_INVALID_CONTROL_FRAME);
         } else if (protocol_version() <= SPDY3 &&
                    current_frame_flags_ & ~CONTROL_FLAG_FIN) {
           set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
         } else if (protocol_version() > SPDY3 &&
                    current_frame_flags_ &
                        ~(CONTROL_FLAG_FIN | HEADERS_FLAG_PRIORITY |
                          HEADERS_FLAG_END_HEADERS | HEADERS_FLAG_END_SEGMENT |
-                         HEADERS_FLAG_PAD_LOW | HEADERS_FLAG_PAD_HIGH)) {
+                         HEADERS_FLAG_PADDED)) {
           set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
         }
       }
       break;
     case WINDOW_UPDATE:
       if (current_frame_length_ != GetWindowUpdateSize()) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case BLOCKED:
       if (current_frame_length_ != GetBlockedSize() ||
           protocol_version() <= SPDY3) {
         // TODO(mlavan): BLOCKED frames are no longer part of SPDY4.
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case PUSH_PROMISE:
       if (current_frame_length_ < GetPushPromiseMinimumSize()) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (protocol_version() <= SPDY3 && current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       } else if (protocol_version() > SPDY3 &&
                  current_frame_flags_ &
                      ~(PUSH_PROMISE_FLAG_END_PUSH_PROMISE |
-                       HEADERS_FLAG_PAD_LOW | HEADERS_FLAG_PAD_HIGH)) {
+                       HEADERS_FLAG_PADDED)) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case CONTINUATION:
       if (current_frame_length_ < GetContinuationMinimumSize() ||
           protocol_version() <= SPDY3) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
-      } else if (current_frame_flags_ &
-                 ~(HEADERS_FLAG_END_HEADERS | HEADERS_FLAG_PAD_LOW |
-                   HEADERS_FLAG_PAD_HIGH)) {
+      } else if (current_frame_flags_ & ~HEADERS_FLAG_END_HEADERS) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case ALTSVC:
       if (current_frame_length_ <= GetAltSvcMinimumSize()) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
@@ skipping 521 matching lines @@
           if (debug_visitor_) {
             debug_visitor_->OnReceiveCompressedFrame(
                 current_frame_stream_id_,
                 current_frame_type_,
                 current_frame_length_);
           }
           visitor_->OnContinuation(current_frame_stream_id_,
                                    (current_frame_flags_ &
                                     HEADERS_FLAG_END_HEADERS) != 0);
         }
-        CHANGE_STATE(SPDY_READ_PADDING_LENGTH);
+        CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
         break;
       default:
         DCHECK(false);
     }
   }
   return original_len - len;
 }
 
 // Does not buffer the control payload. Instead, either passes directly to the
 // visitor or decompresses and then passes directly to the visitor, via
@@ skipping 69 matching lines @@
   return process_bytes;
 }
 
 size_t SpdyFramer::ProcessSettingsFramePayload(const char* data,
                                                size_t data_len) {
   DCHECK_EQ(SPDY_SETTINGS_FRAME_PAYLOAD, state_);
   DCHECK_EQ(SETTINGS, current_frame_type_);
   size_t unprocessed_bytes = std::min(data_len, remaining_data_length_);
   size_t processed_bytes = 0;
 
-  size_t setting_size = protocol_version() <= SPDY3 ? 8 : 5;
+  size_t setting_size = SpdyConstants::GetSettingSize(protocol_version());
 
   // Loop over our incoming data.
   while (unprocessed_bytes > 0) {
     // Process up to one setting at a time.
     size_t processing = std::min(
         unprocessed_bytes,
         static_cast<size_t>(setting_size - settings_scratch_.setting_buf_len));
 
     // Check if we have a complete setting in our input.
     if (processing == setting_size) {
@@ skipping 73 matching lines @@
   // Extract fields.
   // Maintain behavior of old SPDY 2 bug with byte ordering of flags/id.
   if (protocol_version() <= SPDY3) {
     const uint32 id_and_flags_wire = *(reinterpret_cast<const uint32*>(data));
     SettingsFlagsAndId id_and_flags =
       SettingsFlagsAndId::FromWireFormat(protocol_version(), id_and_flags_wire);
     id_field = id_and_flags.id();
     flags = id_and_flags.flags();
     value = ntohl(*(reinterpret_cast<const uint32*>(data + 4)));
   } else {
-    id_field = *(reinterpret_cast<const uint8*>(data));
-    value = ntohl(*(reinterpret_cast<const uint32*>(data + 1)));
+    id_field = ntohs(*(reinterpret_cast<const uint16*>(data)));
+    value = ntohl(*(reinterpret_cast<const uint32*>(data + 2)));
   }
 
   // Validate id.
   if (!SpdyConstants::IsValidSettingId(protocol_version(), id_field)) {
     DLOG(WARNING) << "Unknown SETTINGS ID: " << id_field;
     return false;
   }
   id = SpdyConstants::ParseSettingId(protocol_version(), id_field);
 
   if (protocol_version() <= SPDY3) {
@@ skipping 65 matching lines @@
         }
         break;
       case BLOCKED: {
           DCHECK_LT(SPDY3, protocol_version());
           DCHECK(reader.IsDoneReading());
           visitor_->OnBlocked(current_frame_stream_id_);
         }
         break;
       case PRIORITY: {
           DCHECK_LT(SPDY3, protocol_version());
-          // TODO(hkhalil): Process PRIORITY frames rather than ignore them.
-          reader.Seek(5);
+          uint32 parent_stream_id;
+          uint8 weight;
+          bool exclusive;
+          bool successful_read = true;
+          successful_read = reader.ReadUInt32(&parent_stream_id);
+          DCHECK(successful_read);
+          // Exclusivity is indicated by a single bit flag.
+          exclusive = (parent_stream_id >> 31) != 0;
+          // Zero out the highest-order bit to get the parent stream id.
+          parent_stream_id &= 0x7fffffff;
+          successful_read = reader.ReadUInt8(&weight);
+          DCHECK(successful_read);
           DCHECK(reader.IsDoneReading());
+          visitor_->OnPriority(
+              current_frame_stream_id_, parent_stream_id, weight, exclusive);
         }
         break;
       default:
         // Unreachable.
         LOG(FATAL) << "Unhandled control frame " << current_frame_type_;
     }
 
     CHANGE_STATE(SPDY_IGNORE_REMAINING_PAYLOAD);
   }
   return original_len - len;
@@ skipping 255 matching lines @@
                        StringPiece(altsvc_scratch_.host.get(),
                                    altsvc_scratch_.host_len),
                        StringPiece(altsvc_scratch_.origin.get(),
                                    altsvc_scratch_.origin_len));
     CHANGE_STATE(SPDY_AUTO_RESET);
   }
 
   return processed_bytes;
 }
 
+// TODO(raullenchai): ProcessFramePaddingLength should be able to deal with
+// HEADERS_FLAG_PADDED and PUSH_PROMISE_FLAG_PADDED as well (see b/15777051).
 size_t SpdyFramer::ProcessFramePaddingLength(const char* data, size_t len) {
   DCHECK_EQ(SPDY_READ_PADDING_LENGTH, state_);
+  DCHECK_EQ(remaining_padding_payload_length_, 0u);
 
   size_t original_len = len;
-  if (remaining_padding_length_fields_ == 0) {
-    DCHECK_EQ(remaining_padding_payload_length_, 0u);
-    bool pad_low = false;
-    bool pad_high = false;
-    if (current_frame_flags_ & DATA_FLAG_PAD_LOW) {
-      pad_low = true;
-      ++remaining_padding_length_fields_;
-    }
-    if (current_frame_flags_ & DATA_FLAG_PAD_HIGH) {
-      pad_high = true;
-      ++remaining_padding_length_fields_;
-    }
-    if ((pad_high && !pad_low) ||
-        remaining_data_length_ < remaining_padding_length_fields_) {
-      set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
+  if (current_frame_flags_ & DATA_FLAG_PADDED) {
+    if (len != 0) {
+      if (remaining_data_length_ < 1) {
+        set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
+        return 0;
+      }
+
+      remaining_padding_payload_length_ = *reinterpret_cast<const uint8*>(data);
+      ++data;
+      --len;
+      --remaining_data_length_;
+    } else {
+      // We don't have the data available for parsing the pad length field. Keep
+      // waiting.
       return 0;
     }
   }
 
-  // Parse the padding length.
-  while (len != 0 && remaining_padding_length_fields_ != 0) {
-    remaining_padding_payload_length_ =
-        (remaining_padding_payload_length_ << 8) +
-        *reinterpret_cast<const uint8*>(data);
-    ++data;
-    --len;
-    --remaining_padding_length_fields_;
-    --remaining_data_length_;
+  if (remaining_padding_payload_length_ > remaining_data_length_) {
+    set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
+    return 0;
   }
-
-  if (remaining_padding_length_fields_ == 0) {
-    if (remaining_padding_payload_length_ > remaining_data_length_) {
-      set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
-      return 0;
-    }
-    if (current_frame_type_ == DATA) {
-      CHANGE_STATE(SPDY_FORWARD_STREAM_FRAME);
-    } else {
-      DCHECK(current_frame_type_ == HEADERS ||
-             current_frame_type_ == PUSH_PROMISE ||
-             current_frame_type_ == CONTINUATION ||
-             current_frame_type_ == SYN_STREAM ||
-             current_frame_type_ == SYN_REPLY)
-          << current_frame_type_;
-      CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
-    }
+  if (current_frame_type_ == DATA) {
+    CHANGE_STATE(SPDY_FORWARD_STREAM_FRAME);
+  } else {
+    DCHECK(current_frame_type_ == HEADERS ||
+           current_frame_type_ == PUSH_PROMISE ||
+           current_frame_type_ == SYN_STREAM ||
+           current_frame_type_ == SYN_REPLY)
+        << current_frame_type_;
+    CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
   }
   return original_len - len;
 }
 
 size_t SpdyFramer::ProcessFramePadding(const char* data, size_t len) {
   DCHECK_EQ(SPDY_CONSUME_PADDING, state_);
 
   size_t original_len = len;
   if (remaining_padding_payload_length_ > 0) {
     DCHECK_EQ(remaining_padding_payload_length_, remaining_data_length_);
@@ skipping 121 matching lines @@
 
 SpdySerializedFrame* SpdyFramer::SerializeData(
     const SpdyDataIR& data_ir) const {
   uint8 flags = DATA_FLAG_NONE;
   if (data_ir.fin()) {
     flags = DATA_FLAG_FIN;
   }
 
   if (protocol_version() > SPDY3) {
     int num_padding_fields = 0;
-    if (data_ir.pad_low()) {
-      flags |= DATA_FLAG_PAD_LOW;
-      ++num_padding_fields;
-    }
-    if (data_ir.pad_high()) {
-      flags |= DATA_FLAG_PAD_HIGH;
+    if (data_ir.padded()) {
+      flags |= DATA_FLAG_PADDED;
       ++num_padding_fields;
     }
 
     const size_t size_with_padding = num_padding_fields +
         data_ir.data().length() + data_ir.padding_payload_len() +
         GetDataFrameMinimumSize();
     SpdyFrameBuilder builder(size_with_padding, protocol_version());
     builder.WriteDataFrameHeader(*this, data_ir.stream_id(), flags);
-    if (data_ir.pad_high()) {
-      builder.WriteUInt8(data_ir.padding_payload_len() >> 8);
-    }
-    if (data_ir.pad_low()) {
+    if (data_ir.padded()) {
       builder.WriteUInt8(data_ir.padding_payload_len() & 0xff);
     }
     builder.WriteBytes(data_ir.data().data(), data_ir.data().length());
     if (data_ir.padding_payload_len() > 0) {
       string padding = string(data_ir.padding_payload_len(), '0');
       builder.WriteBytes(padding.data(), padding.length());
     }
     DCHECK_EQ(size_with_padding, builder.length());
     return builder.take();
   } else {
     const size_t size = GetDataFrameMinimumSize() + data_ir.data().length();
     SpdyFrameBuilder builder(size, protocol_version());
     builder.WriteDataFrameHeader(*this, data_ir.stream_id(), flags);
     builder.WriteBytes(data_ir.data().data(), data_ir.data().length());
     DCHECK_EQ(size, builder.length());
     return builder.take();
   }
 }
 
 SpdySerializedFrame* SpdyFramer::SerializeDataFrameHeaderWithPaddingLengthField(
     const SpdyDataIR& data_ir) const {
   uint8 flags = DATA_FLAG_NONE;
   if (data_ir.fin()) {
     flags = DATA_FLAG_FIN;
   }
 
   size_t frame_size = GetDataFrameMinimumSize();
   size_t num_padding_fields = 0;
   if (protocol_version() > SPDY3) {
-    if (data_ir.pad_low()) {
-      flags |= DATA_FLAG_PAD_LOW;
-      ++num_padding_fields;
-    }
-    if (data_ir.pad_high()) {
-      flags |= DATA_FLAG_PAD_HIGH;
+    if (data_ir.padded()) {
+      flags |= DATA_FLAG_PADDED;
       ++num_padding_fields;
     }
     frame_size += num_padding_fields;
   }
 
   SpdyFrameBuilder builder(frame_size, protocol_version());
   builder.WriteDataFrameHeader(*this, data_ir.stream_id(), flags);
   if (protocol_version() > SPDY3) {
-    if (data_ir.pad_high()) {
-      builder.WriteUInt8(data_ir.padding_payload_len() >> 8);
-    }
-    if (data_ir.pad_low()) {
+    if (data_ir.padded()) {
       builder.WriteUInt8(data_ir.padding_payload_len() & 0xff);
     }
     builder.OverwriteLength(*this,  num_padding_fields +
         data_ir.data().length() + data_ir.padding_payload_len());
   } else {
     builder.OverwriteLength(*this, data_ir.data().length());
   }
   DCHECK_EQ(frame_size, builder.length());
   return builder.take();
 }
 
 SpdySerializedFrame* SpdyFramer::SerializeSynStream(
     const SpdySynStreamIR& syn_stream) {
+  DCHECK_GE(SPDY3, protocol_version());
   uint8 flags = 0;
   if (syn_stream.fin()) {
     flags |= CONTROL_FLAG_FIN;
   }
   if (syn_stream.unidirectional()) {
     // TODO(hkhalil): invalid for HTTP2.
     flags |= CONTROL_FLAG_UNIDIRECTIONAL;
   }
-  // In SPDY >= 4, SYN_STREAM frames are HEADERS frames, but for now
-  // we never expect to have to overflow into a CONTINUATION frame.
-  if (protocol_version() > SPDY3) {
-    flags |= HEADERS_FLAG_PRIORITY;
-    flags |= HEADERS_FLAG_END_HEADERS;
-  }
 
   // Sanitize priority.
   uint8 priority = syn_stream.priority();
   if (priority > GetLowestPriority()) {
     DLOG(DFATAL) << "Priority out-of-bounds.";
     priority = GetLowestPriority();
   }
 
   // The size of this frame, including variable-length name-value block.
-  size_t size = GetSynStreamMinimumSize();
-
-  string hpack_encoding;
-  if (protocol_version() > SPDY3) {
-    if (enable_compression_) {
-      GetHpackEncoder()->EncodeHeaderSet(
-          syn_stream.name_value_block(), &hpack_encoding);
-    } else {
-      GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
-          syn_stream.name_value_block(), &hpack_encoding);
-    }
-    size += hpack_encoding.size();
-  } else {
-    size += GetSerializedLength(syn_stream.name_value_block());
-  }
+  size_t size = GetSynStreamMinimumSize() +
+      GetSerializedLength(syn_stream.name_value_block());
 
   SpdyFrameBuilder builder(size, protocol_version());
-  if (protocol_version() <= SPDY3) {
-    builder.WriteControlFrameHeader(*this, SYN_STREAM, flags);
-    builder.WriteUInt32(syn_stream.stream_id());
-    builder.WriteUInt32(syn_stream.associated_to_stream_id());
-    builder.WriteUInt8(priority << ((protocol_version() <= SPDY2) ? 6 : 5));
-    builder.WriteUInt8(0);  // Unused byte where credential slot used to be.
-  } else {
-    builder.BeginNewFrame(*this,
-                          HEADERS,
-                          flags,
-                          syn_stream.stream_id());
-    // TODO(jgraettinger): Plumb priorities and stream dependencies.
-    builder.WriteUInt32(0);  // Non-exclusive bit and root stream ID.
-    builder.WriteUInt8(MapPriorityToWeight(priority));
-  }
+  builder.WriteControlFrameHeader(*this, SYN_STREAM, flags);
+  builder.WriteUInt32(syn_stream.stream_id());
+  builder.WriteUInt32(syn_stream.associated_to_stream_id());
+  builder.WriteUInt8(priority << ((protocol_version() <= SPDY2) ? 6 : 5));
+  builder.WriteUInt8(0);  // Unused byte where credential slot used to be.
   DCHECK_EQ(GetSynStreamMinimumSize(), builder.length());
-  if (protocol_version() > SPDY3) {
-    builder.WriteBytes(&hpack_encoding[0], hpack_encoding.size());
-  } else {
-    SerializeNameValueBlock(&builder, syn_stream);
-  }
+  SerializeNameValueBlock(&builder, syn_stream);
 
   if (debug_visitor_) {
-    const size_t payload_len = protocol_version() > SPDY3 ?
-        hpack_encoding.size() :
+    const size_t payload_len =
         GetSerializedLength(protocol_version(),
                             &(syn_stream.name_value_block()));
     // SPDY 4 reports this compression as a SYN_STREAM compression.
     debug_visitor_->OnSendCompressedFrame(syn_stream.stream_id(),
                                           SYN_STREAM,
                                           payload_len,
                                           builder.length());
   }
 
   return builder.take();
 }
 
 SpdySerializedFrame* SpdyFramer::SerializeSynReply(
     const SpdySynReplyIR& syn_reply) {
+  DCHECK_GE(SPDY3, protocol_version());
   uint8 flags = 0;
   if (syn_reply.fin()) {
     flags |= CONTROL_FLAG_FIN;
   }
-  // In SPDY >= 4, SYN_REPLY frames are HEADERS frames, but for now
-  // we never expect to have to overflow into a CONTINUATION frame.
-  if (protocol_version() > SPDY3) {
-    flags |= HEADERS_FLAG_END_HEADERS;
-  }
 
   // The size of this frame, including variable-length name-value block.
-  size_t size = GetSynReplyMinimumSize();
-
-  string hpack_encoding;
-  if (protocol_version() > SPDY3) {
-    if (enable_compression_) {
-      GetHpackEncoder()->EncodeHeaderSet(
-          syn_reply.name_value_block(), &hpack_encoding);
-    } else {
-      GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
-          syn_reply.name_value_block(), &hpack_encoding);
-    }
-    size += hpack_encoding.size();
-  } else {
-    size += GetSerializedLength(syn_reply.name_value_block());
-  }
+  const size_t size = GetSynReplyMinimumSize() +
+                      GetSerializedLength(syn_reply.name_value_block());
 
   SpdyFrameBuilder builder(size, protocol_version());
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, SYN_REPLY, flags);
     builder.WriteUInt32(syn_reply.stream_id());
   } else {
     builder.BeginNewFrame(*this,
                           HEADERS,
                           flags,
                           syn_reply.stream_id());
   }
   if (protocol_version() < SPDY3) {
     builder.WriteUInt16(0);  // Unused.
   }
   DCHECK_EQ(GetSynReplyMinimumSize(), builder.length());
-  if (protocol_version() > SPDY3) {
-    builder.WriteBytes(&hpack_encoding[0], hpack_encoding.size());
-  } else {
-    SerializeNameValueBlock(&builder, syn_reply);
-  }
+  SerializeNameValueBlock(&builder, syn_reply);
 
   if (debug_visitor_) {
-    const size_t payload_len = protocol_version() > SPDY3 ?
-        hpack_encoding.size() :
-        GetSerializedLength(protocol_version(),
-                            &(syn_reply.name_value_block()));
+    const size_t payload_len = GetSerializedLength(
+        protocol_version(), &(syn_reply.name_value_block()));
     debug_visitor_->OnSendCompressedFrame(syn_reply.stream_id(),
                                           SYN_REPLY,
                                           payload_len,
                                           builder.length());
   }
 
   return builder.take();
 }
 
 SpdySerializedFrame* SpdyFramer::SerializeRstStream(
@@ skipping 37 matching lines @@
     if (settings.clear_settings()) {
       flags |= SETTINGS_FLAG_CLEAR_PREVIOUSLY_PERSISTED_SETTINGS;
     }
   } else {
     if (settings.is_ack()) {
       flags |= SETTINGS_FLAG_ACK;
     }
   }
   const SpdySettingsIR::ValueMap* values = &(settings.values());
 
-  size_t setting_size = (protocol_version() <= SPDY3 ? 8 : 5);
+  size_t setting_size = SpdyConstants::GetSettingSize(protocol_version());
   // Size, in bytes, of this SETTINGS frame.
   const size_t size = GetSettingsMinimumSize() +
                       (values->size() * setting_size);
   SpdyFrameBuilder builder(size, protocol_version());
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, SETTINGS, flags);
   } else {
     builder.BeginNewFrame(*this, SETTINGS, flags, 0);
   }
 
@@ skipping 16 matching lines @@
       }
       if (it->second.persisted) {
         setting_flags |= SETTINGS_FLAG_PERSISTED;
       }
       SettingsFlagsAndId flags_and_id(
           setting_flags,
           SpdyConstants::SerializeSettingId(protocol_version(), it->first));
       uint32 id_and_flags_wire = flags_and_id.GetWireFormat(protocol_version());
       builder.WriteBytes(&id_and_flags_wire, 4);
     } else {
-      builder.WriteUInt8(SpdyConstants::SerializeSettingId(protocol_version(),
-                                                           it->first));
+      builder.WriteUInt16(SpdyConstants::SerializeSettingId(protocol_version(),
+                                                            it->first));
     }
     builder.WriteUInt32(it->second.value);
   }
   DCHECK_EQ(size, builder.length());
   return builder.take();
 }
 
 SpdySerializedFrame* SpdyFramer::SerializePing(const SpdyPingIR& ping) const {
   SpdyFrameBuilder builder(GetPingSize(), protocol_version());
   if (protocol_version() <= SPDY3) {
@@ skipping 64 matching lines @@
 
   // The size of this frame, including variable-length name-value block.
   size_t size = GetHeadersMinimumSize();
 
   uint32 priority = headers.priority();
   if (headers.has_priority()) {
     if (priority > GetLowestPriority()) {
       DLOG(DFATAL) << "Priority out-of-bounds.";
       priority = GetLowestPriority();
     }
-    size += 4;
+    size += 5;
   }
 
   string hpack_encoding;
   if (protocol_version() > SPDY3) {
     if (enable_compression_) {
       GetHpackEncoder()->EncodeHeaderSet(
           headers.name_value_block(), &hpack_encoding);
     } else {
       GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
           headers.name_value_block(), &hpack_encoding);
@@ skipping 10 matching lines @@
 
   SpdyFrameBuilder builder(size, protocol_version());
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, HEADERS, flags);
     builder.WriteUInt32(headers.stream_id());
   } else {
     builder.BeginNewFrame(*this,
                           HEADERS,
                           flags,
                           headers.stream_id());
-    if (headers.has_priority()) {
-      // TODO(jgraettinger): Plumb priorities and stream dependencies.
-      builder.WriteUInt32(0);  // Non-exclusive bit and root stream ID.
-      builder.WriteUInt8(MapPriorityToWeight(priority));
-    }
   }
   if (protocol_version() <= SPDY2) {
     builder.WriteUInt16(0);  // Unused.
   }
   DCHECK_EQ(GetHeadersMinimumSize(), builder.length());
 
   if (protocol_version() > SPDY3) {
+    if (headers.has_priority()) {
+      // TODO(jgraettinger): Plumb priorities and stream dependencies.
+      builder.WriteUInt32(0);  // Non-exclusive bit and root stream ID.
+      builder.WriteUInt8(MapPriorityToWeight(priority));
+    }
     WritePayloadWithContinuation(&builder,
                                  hpack_encoding,
                                  headers.stream_id(),
                                  HEADERS);
   } else {
     SerializeNameValueBlock(&builder, headers);
   }
 
   if (debug_visitor_) {
     const size_t payload_len = protocol_version() > SPDY3 ?
@@ skipping 36 matching lines @@
 SpdyFrame* SpdyFramer::SerializePushPromise(
     const SpdyPushPromiseIR& push_promise) {
   DCHECK_LT(SPDY3, protocol_version());
   uint8 flags = 0;
   // This will get overwritten if we overflow into a CONTINUATION frame.
   flags |= PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
   // The size of this frame, including variable-length name-value block.
   size_t size = GetPushPromiseMinimumSize();
 
   string hpack_encoding;
-  if (protocol_version() > SPDY3) {
-    if (enable_compression_) {
-      GetHpackEncoder()->EncodeHeaderSet(
-          push_promise.name_value_block(), &hpack_encoding);
-    } else {
-      GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
-          push_promise.name_value_block(), &hpack_encoding);
-    }
-    size += hpack_encoding.size();
-    if (size > GetControlFrameBufferMaxSize()) {
-      size += GetNumberRequiredContinuationFrames(size) *
-              GetContinuationMinimumSize();
-      flags &= ~PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
-    }
+  if (enable_compression_) {
+    GetHpackEncoder()->EncodeHeaderSet(
+        push_promise.name_value_block(), &hpack_encoding);
   } else {
-    size += GetSerializedLength(push_promise.name_value_block());
+    GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
+        push_promise.name_value_block(), &hpack_encoding);
+  }
+  size += hpack_encoding.size();
+  if (size > GetControlFrameBufferMaxSize()) {
+    size += GetNumberRequiredContinuationFrames(size) *
+            GetContinuationMinimumSize();
+    flags &= ~PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
   }
 
   SpdyFrameBuilder builder(size, protocol_version());
   builder.BeginNewFrame(*this,
                         PUSH_PROMISE,
                         flags,
                         push_promise.stream_id());
   builder.WriteUInt32(push_promise.promised_stream_id());
   DCHECK_EQ(GetPushPromiseMinimumSize(), builder.length());
 
-  if (protocol_version() > SPDY3) {
-    WritePayloadWithContinuation(&builder,
-                                 hpack_encoding,
-                                 push_promise.stream_id(),
-                                 PUSH_PROMISE);
-  } else {
-    SerializeNameValueBlock(&builder, push_promise);
-  }
+  WritePayloadWithContinuation(&builder,
+                               hpack_encoding,
+                               push_promise.stream_id(),
+                               PUSH_PROMISE);
 
   if (debug_visitor_) {
-    const size_t payload_len = protocol_version() > SPDY3 ?
-        hpack_encoding.size() :
-        GetSerializedLength(protocol_version(),
-                            &(push_promise.name_value_block()));
     debug_visitor_->OnSendCompressedFrame(push_promise.stream_id(),
-        PUSH_PROMISE, payload_len, builder.length());
+        PUSH_PROMISE, hpack_encoding.size(), builder.length());
   }
 
   return builder.take();
 }
 
 // TODO(jgraettinger): This implementation is incorrect. The continuation
 // frame continues a previously-begun HPACK encoding; it doesn't begin a
 // new one. Figure out whether it makes sense to keep SerializeContinuation().
 SpdyFrame* SpdyFramer::SerializeContinuation(
     const SpdyContinuationIR& continuation) {
@@ skipping 47 matching lines @@
   builder.WriteUInt8(altsvc.protocol_id().length());
   builder.WriteBytes(altsvc.protocol_id().data(),
                      altsvc.protocol_id().length());
   builder.WriteUInt8(altsvc.host().length());
   builder.WriteBytes(altsvc.host().data(), altsvc.host().length());
   builder.WriteBytes(altsvc.origin().data(), altsvc.origin().length());
   DCHECK_LT(GetAltSvcMinimumSize(), builder.length());
   return builder.take();
 }
 
+SpdyFrame* SpdyFramer::SerializePriority(const SpdyPriorityIR& priority) {
+  DCHECK_LT(SPDY3, protocol_version());
+  size_t size = GetPrioritySize();
+
+  SpdyFrameBuilder builder(size, protocol_version());
+  builder.BeginNewFrame(*this, PRIORITY, kNoFlags, priority.stream_id());
+
+  // Make sure the highest-order bit in the parent stream id is zeroed out.
+  uint32 parent_stream_id = priority.parent_stream_id() & 0x7fffffff;
+  uint32 exclusive = priority.exclusive() ? 0x80000000 : 0;
+  // Set the one-bit exclusivity flag.
+  uint32 flag_and_parent_id = parent_stream_id | exclusive;
+  builder.WriteUInt32(flag_and_parent_id);
+  builder.WriteUInt8(priority.weight());
+  DCHECK_EQ(GetPrioritySize(), builder.length());
+  return builder.take();
+}
+
 namespace {
 
 class FrameSerializationVisitor : public SpdyFrameVisitor {
  public:
   explicit FrameSerializationVisitor(SpdyFramer* framer) : framer_(framer) {}
   virtual ~FrameSerializationVisitor() {}
 
   SpdySerializedFrame* ReleaseSerializedFrame() { return frame_.release(); }
 
   virtual void VisitData(const SpdyDataIR& data) OVERRIDE {
@@ skipping 31 matching lines @@
       const SpdyPushPromiseIR& push_promise) OVERRIDE {
     frame_.reset(framer_->SerializePushPromise(push_promise));
   }
   virtual void VisitContinuation(
       const SpdyContinuationIR& continuation) OVERRIDE {
     frame_.reset(framer_->SerializeContinuation(continuation));
   }
   virtual void VisitAltSvc(const SpdyAltSvcIR& altsvc) OVERRIDE {
     frame_.reset(framer_->SerializeAltSvc(altsvc));
   }
+  virtual void VisitPriority(const SpdyPriorityIR& priority) OVERRIDE {
+    frame_.reset(framer_->SerializePriority(priority));
+  }
 
  private:
   SpdyFramer* framer_;
   scoped_ptr<SpdySerializedFrame> frame_;
 };
 
 }  // namespace
 
 SpdySerializedFrame* SpdyFramer::SerializeFrame(const SpdyFrameIR& frame) {
   FrameSerializationVisitor visitor(this);
@@ skipping 342 matching lines @@
   builder->Seek(compressed_size);
   builder->RewriteLength(*this);
 
   pre_compress_bytes.Add(uncompressed_len);
   post_compress_bytes.Add(compressed_size);
 
   compressed_frames.Increment();
 }
 
 }  // namespace net