Fix a SPDY crash bug where a CHECK() is hit because a cancelled stream is considered active by the …

net/spdy/spdy_stream.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_stream.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "base/stringprintf.h"
@@ skipping 69 matching lines @@
     : public SpdySession::SpdyIOBufferProducer {
  public:
   SpdyStreamIOBufferProducer(SpdyStream* stream) : stream_(stream) {}
 
   // SpdyFrameProducer
   virtual RequestPriority GetPriority() const OVERRIDE {
     return stream_->priority();
   }
 
   virtual SpdyIOBuffer* ProduceNextBuffer(SpdySession* session) OVERRIDE {
+    if (stream_->cancelled())
+      return NULL;
     if (stream_->stream_id() == 0)
       SpdySession::SpdyIOBufferProducer::ActivateStream(session, stream_);
     frame_.reset(stream_->ProduceNextFrame());
     return frame_ == NULL ? NULL :
         SpdySession::SpdyIOBufferProducer::CreateIOBuffer(
             frame_.get(), GetPriority(), stream_);
   }
 
  private:
   scoped_refptr<SpdyStream> stream_;
@@ skipping 419 matching lines @@
     delegate->OnClose(status);
 }
 
 void SpdyStream::Cancel() {
   if (cancelled())
     return;
 
   cancelled_ = true;
   if (session_->IsStreamActive(stream_id_))
     session_->ResetStream(stream_id_, CANCEL, "");
+  else
+    session_->DeleteCreatedStream(this);
+
+  CHECK(!session_->IsStreamActive(stream_id_));
 }
 
 void SpdyStream::Close() {
   if (stream_id_ != 0)
     session_->CloseStream(stream_id_, net::OK);
   else
     session_->CloseCreatedStream(this, OK);
 }
 
 int SpdyStream::SendRequest(bool has_upload_data) {
@@ skipping 255 matching lines @@
   UMA_HISTOGRAM_TIMES("Net.SpdyStreamDownloadTime",
       recv_last_byte_time_ - recv_first_byte_time_);
   UMA_HISTOGRAM_TIMES("Net.SpdyStreamTime",
       recv_last_byte_time_ - send_time_);
 
   UMA_HISTOGRAM_COUNTS("Net.SpdySendBytes", send_bytes_);
   UMA_HISTOGRAM_COUNTS("Net.SpdyRecvBytes", recv_bytes_);
 }
 
 }  // namespace net