Fix out of order SYN_STEAM frames.

net/spdy/spdy_stream.h

Index: net/spdy/spdy_stream.h
diff --git a/net/spdy/spdy_stream.h b/net/spdy/spdy_stream.h
index 3e81ecf1ff4dbb0c205be10efb92dfe6e95210e7..23a2236cc69809c276c2acf2775538b37f221747 100644
--- a/net/spdy/spdy_stream.h
+++ b/net/spdy/spdy_stream.h
@@ -6,6 +6,7 @@
 #define NET_SPDY_SPDY_STREAM_H_
 #pragma once
 
+#include <list>
 #include <string>
 #include <vector>
 
@@ -24,12 +25,12 @@
 #include "net/socket/ssl_client_socket.h"
 #include "net/spdy/spdy_framer.h"
 #include "net/spdy/spdy_protocol.h"
+#include "net/spdy/spdy_session.h"
 
 namespace net {
 
 class AddressList;
 class IPEndPoint;
-class SpdySession;
 class SSLCertRequestInfo;
 class SSLInfo;
 
@@ -95,10 +96,11 @@ class NET_EXPORT_PRIVATE SpdyStream
 
   // SpdyStream constructor
   SpdyStream(SpdySession* session,
-             SpdyStreamId stream_id,
              bool pushed,
              const BoundNetLog& net_log);
 
+  SpdySession::SpdyFrameProducer* CreateProducer();
+
   // Set new |delegate|. |delegate| must not be NULL.
   // If it already received SYN_REPLY or data, OnResponseReceived() or
   // OnDataReceived() will be called.
@@ -260,6 +262,8 @@ class NET_EXPORT_PRIVATE SpdyStream
   int GetProtocolVersion() const;
 
  private:
+  class SpdyStreamFrameProducer;
+
   enum State {
     STATE_NONE,
     STATE_GET_DOMAIN_BOUND_CERT,
@@ -308,6 +312,11 @@ class NET_EXPORT_PRIVATE SpdyStream
   // the MessageLoop to replay all the data that the server has already sent.
   void PushedStreamReplayData();
 
+  // Returns a newly created SPDY frame owned by the called that contains
+  // the next frame to be sent by this frame.  May return NULL if this
+  // stream has become stalled on flow control.
+  SpdyFrame* ProduceNextFrame();
+
   // There is a small period of time between when a server pushed stream is
   // first created, and the pushed data is replayed. Any data received during
   // this time should continue to be buffered.
@@ -343,6 +352,8 @@ class NET_EXPORT_PRIVATE SpdyStream
   linked_ptr<SpdyHeaderBlock> response_;
   base::Time response_time_;
 
+  std::list<SpdyFrame*> pending_data_frames_;
+
   State io_state_;
 
   // Since we buffer the response, we also buffer the response status.