SPDY - Small bug fix for user after free. Will revert the

net/spdy/spdy_session.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_session.h"
 
 #include <map>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
@@ skipping 776 matching lines @@
 }
 
 void SpdySession::StartRead() {
   DCHECK_NE(state_, STATE_DO_READ_COMPLETE);
   read_pending_ = false;
   DoLoop(OK);
 }
 
 int SpdySession::DoLoop(int result) {
   bytes_read_ = 0;
+
+  // The SpdyFramer will use callbacks onto |this| as it parses frames.
+  // When errors occur, those callbacks can lead to teardown of all references
+  // to |this|, so maintain a reference to self during this call for safe
+  // cleanup.
+  scoped_refptr<SpdySession> self(this);
+
   do {
     if (read_pending_)
       return OK;
 
     switch (state_) {
       case STATE_DO_READ:
         DCHECK_EQ(result, OK);
         result = DoRead();
         break;
       case STATE_DO_READ_COMPLETE:
@@ skipping 48 matching lines @@
       error = ERR_CONNECTION_CLOSED;
     CloseSessionOnError(error, true, "result is <= 0.");
     return ERR_CONNECTION_CLOSED;
   }
 
   total_bytes_received_ += result;
   bytes_read_ += result;
 
   last_activity_time_ = base::TimeTicks::Now();
 
-  // The SpdyFramer will use callbacks onto |this| as it parses frames.
-  // When errors occur, those callbacks can lead to teardown of all references
-  // to |this|, so maintain a reference to self during this call for safe
-  // cleanup.
-  scoped_refptr<SpdySession> self(this);
-
   DCHECK(buffered_spdy_framer_.get());
   char *data = read_buffer_->data();
   while (result &&
          buffered_spdy_framer_->error_code() ==
              SpdyFramer::SPDY_NO_ERROR) {
     uint32 bytes_processed =
         buffered_spdy_framer_->ProcessInput(data, result);
     result -= bytes_processed;
     data += bytes_processed;
     if (buffered_spdy_framer_->state() == SpdyFramer::SPDY_DONE)
@@ skipping 1115 matching lines @@
 SSLClientSocket* SpdySession::GetSSLClientSocket() const {
   if (!is_secure_)
     return NULL;
   SSLClientSocket* ssl_socket =
       reinterpret_cast<SSLClientSocket*>(connection_->socket());
   DCHECK(ssl_socket);
   return ssl_socket;
 }
 
 }  // namespace net