Fix crash in handling PushStreams

net/spdy/spdy_session.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_session.h"
 
 #include <algorithm>
 #include <map>
 
 #include "base/basictypes.h"
@@ skipping 2685 matching lines @@
   // In spdy4/http2 PUSH_PROMISE arrives on associated stream.
   if (associated_it != active_streams_.end() && GetProtocolVersion() >= SPDY4) {
     associated_it->second.stream->IncrementRawReceivedBytes(
         last_compressed_frame_len_);
   } else {
     stream->IncrementRawReceivedBytes(last_compressed_frame_len_);
   }
 
   last_compressed_frame_len_ = 0;
 
-  DeleteExpiredPushedStreams();

[szym, 2014/12/18 06:34:38]

This is definitely a bug and the solution makes sense to me.

The only thing that I'd ask for is a unit test to cover this situation.

[Ryan Hamilton, 2015/01/07 19:32:14]

+1 for a test.

   PushedStreamMap::iterator inserted_pushed_it =
       unclaimed_pushed_streams_.insert(
           pushed_it,
           std::make_pair(gurl, PushedStreamInfo(stream_id, time_func_())));
   DCHECK(inserted_pushed_it != pushed_it);
+  DeleteExpiredPushedStreams();
 
   InsertActivatedStream(stream.Pass());
 
   ActiveStreamMap::iterator active_it = active_streams_.find(stream_id);
   if (active_it == active_streams_.end()) {
     NOTREACHED();
     return false;
   }
 
   active_it->second.stream->OnPushPromiseHeadersReceived(headers);
@@ skipping 552 matching lines @@
     if (!queue->empty()) {
       SpdyStreamId stream_id = queue->front();
       queue->pop_front();
       return stream_id;
     }
   }
   return 0;
 }
 
 }  // namespace net