Fix a bug in QuicUnackedPacketMap where an in flight packet could be

net/quic/quic_unacked_packet_map.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_unacked_packet_map.h"
 
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "net/quic/quic_connection_stats.h"
 #include "net/quic/quic_utils_chromium.h"
@@ skipping 62 matching lines @@
 
   // We keep the old packet in the unacked packet list until it, or one of
   // the retransmissions of it are acked.
   transmission_info->retransmittable_frames = NULL;
   // Only keep one transmission older than largest observed, because only the
   // most recent is expected to possibly be a spurious retransmission.
   if (transmission_info->all_transmissions->size() > 1 &&
       *(++transmission_info->all_transmissions->begin()) < largest_observed_) {
     QuicPacketSequenceNumber old_transmission =
         *transmission_info->all_transmissions->begin();
-    transmission_info->all_transmissions->erase(old_transmission);
-    unacked_packets_.erase(old_transmission);
+    TransmissionInfo* old_transmission_info =
+        FindOrNull(unacked_packets_, old_transmission);
+    // Don't remove old packets if they're still in flight.
+    if (old_transmission_info == NULL || !old_transmission_info->in_flight) {
+      transmission_info->all_transmissions->erase(old_transmission);
+      unacked_packets_.erase(old_transmission);
+    }
   }
   unacked_packets_[new_sequence_number] =
       TransmissionInfo(frames,
                        new_sequence_number,
                        transmission_info->sequence_number_length,
                        transmission_type,
                        transmission_info->all_transmissions);
 }
 
 void QuicUnackedPacketMap::ClearPreviousRetransmissions(size_t num_to_clear) {
@@ skipping 245 matching lines @@
   }
   DCHECK(!it->second.in_flight);
   DCHECK_NE(0u, it->second.bytes_sent);
   DCHECK(it->second.sent_time.IsInitialized());
 
   bytes_in_flight_ += it->second.bytes_sent;
   it->second.in_flight = true;
 }
 
 }  // namespace net