Fix a crash bug in QuicUnackedPacketMap when truncated acks arrived.

net/quic/quic_unacked_packet_map.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_unacked_packet_map.h"
 
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "net/quic/quic_connection_stats.h"
 #include "net/quic/quic_utils_chromium.h"
@@ skipping 99 matching lines @@
 void QuicUnackedPacketMap::ClearPreviousRetransmissions(size_t num_to_clear) {
   while (!unacked_packets_.empty() && num_to_clear > 0) {
     // If this packet is in flight, or has retransmittable data, then there is
     // no point in clearing out any further packets, because they would not
     // affect the high water mark.
     TransmissionInfo* info = &unacked_packets_.front();
     if (info->in_flight || info->retransmittable_frames != NULL) {
       break;
     }
 
-    info->all_transmissions->pop_front();
-    LOG_IF(DFATAL, info->all_transmissions->empty())
-        << "Previous retransmissions must have a newer transmission.";
+    if (info->all_transmissions != NULL) {
+      if (info->all_transmissions->size() < 2) {
+        LOG(DFATAL) << "all_transmissions must be NULL or have multiple "
+                    << "elements.  size:" << info->all_transmissions->size();
+        delete info->all_transmissions;
+      } else {
+        info->all_transmissions->pop_front();
+        if (info->all_transmissions->size() == 1) {
+          // Set the newer transmission's 'all_transmissions' entry to NULL.
+          QuicPacketSequenceNumber new_transmission =
+              info->all_transmissions->front();
+          TransmissionInfo* new_info =
+              &unacked_packets_.at(new_transmission - least_unacked_);
+          delete new_info->all_transmissions;
+          new_info->all_transmissions = NULL;
+        }
+      }
+    }
     unacked_packets_.pop_front();
     ++least_unacked_;
     --num_to_clear;
   }
 }
 
 bool QuicUnackedPacketMap::HasRetransmittableFrames(
     QuicPacketSequenceNumber sequence_number) const {
   DCHECK_GE(sequence_number, least_unacked_);
   DCHECK_LT(sequence_number, least_unacked_ + unacked_packets_.size());
@@ skipping 191 matching lines @@
   TransmissionInfo* info = &unacked_packets_[sequence_number - least_unacked_];
   DCHECK(!info->in_flight);
   DCHECK_NE(0u, info->bytes_sent);
   DCHECK(info->sent_time.IsInitialized());
 
   bytes_in_flight_ += info->bytes_sent;
   info->in_flight = true;
 }
 
 }  // namespace net