A large Content-Length header followed by a connection close could trigger an...

net/base/io_buffer.cc

Index: net/base/io_buffer.cc
===================================================================
--- net/base/io_buffer.cc	(revision 32433)
+++ net/base/io_buffer.cc	(working copy)
@@ -20,11 +20,9 @@
 }
 
 void GrowableIOBuffer::SetCapacity(int capacity) {
-  CHECK(capacity >= 0);
+  DCHECK(capacity >= 0);
   // realloc will crash if it fails.
   real_data_.reset(static_cast<char*>(realloc(real_data_.release(), capacity)));
-  // Sanity check.
-  CHECK(real_data_.get() != NULL || capacity == 0);
   capacity_ = capacity;
   if (offset_ > capacity)
     set_offset(capacity);