Fix a bug in SpdyProxyClientSocket::PopulateUserBuffer, where

subsequent reads from the same buffered data could result in 
a crash.

BUG=none
TEST=SpdyProxyClientSocketTest.MultipleReadsFromSameLargeFrame

Review URL: http://codereview.chromium.org/3549022

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@61758 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 36 insertions, 2 deletions

diff --git a/net/spdy/spdy_proxy_client_socket.cc b/net/spdy/spdy_proxy_client_socket.cc
index 966a82c..588af81 100644
--- a/net/spdy/spdy_proxy_client_socket.cc
+++ b/net/spdy/spdy_proxy_client_socket.cc
@@ -143,10 +143,10 @@ int SpdyProxyClientSocket::PopulateUserReadBuffer() {
   while (!read_buffer_.empty() && user_buffer_->BytesRemaining() > 0) {
     scoped_refptr<DrainableIOBuffer> data = read_buffer_.front();
     const int bytes_to_copy = std::min(user_buffer_->BytesRemaining(),
-                                       data->size());
+                                       data->BytesRemaining());
     memcpy(user_buffer_->data(), data->data(), bytes_to_copy);
     user_buffer_->DidConsume(bytes_to_copy);
-    if (bytes_to_copy == data->size()) {
+    if (data->BytesRemaining() == 0) {
       // Consumed all data from this buffer
       read_buffer_.pop_front();
     } else {
diff --git a/net/spdy/spdy_proxy_client_socket_unittest.cc b/net/spdy/spdy_proxy_client_socket_unittest.cc
index f2f0d23..c3df858 100644
--- a/net/spdy/spdy_proxy_client_socket_unittest.cc
+++ b/net/spdy/spdy_proxy_client_socket_unittest.cc
@@ -45,6 +45,8 @@ static const char kMsg3[] = "bye!";
 static const int kLen3 = 4;
 static const char kMsg33[] = "bye!bye!";
 static const int kLen33 = kLen3 + kLen3;
+static const char kMsg333[] = "bye!bye!bye!";
+static const int kLen333 = kLen3 + kLen3 + kLen3;
 
 }  // anonymous namespace
 
@@ -763,6 +765,38 @@ TEST_F(SpdyProxyClientSocketTest, ReadWillSplitDataFromLargeFrame) {
   AssertSyncReadEquals(kMsg3, kLen3);
   AssertSyncReadEquals(kMsg3, kLen3);
 }
+
+TEST_F(SpdyProxyClientSocketTest, MultipleReadsFromSameLargeFrame) {
+  scoped_ptr<spdy::SpdyFrame> conn(ConstructConnectRequestFrame());
+  MockWrite writes[] = {
+    CreateMockWrite(*conn, 0, false),
+  };
+
+  scoped_ptr<spdy::SpdyFrame> resp(ConstructConnectReplyFrame());
+  scoped_ptr<spdy::SpdyFrame> msg333(ConstructBodyFrame(kMsg333, kLen333));
+  MockRead reads[] = {
+    CreateMockRead(*resp, 1, true),
+    CreateMockRead(*msg333, 2, true),
+    MockRead(true, 0, 3),  // EOF
+  };
+
+  Initialize(reads, arraysize(reads), writes, arraysize(writes));
+
+  AssertConnectSucceeds();
+
+  Run(1);  // SpdySession consumes the next read and sends it to
+           // sock_ to be buffered.
+  // The payload from the single large data frame will be read across
+  // two different reads.
+  AssertSyncReadEquals(kMsg33, kLen33);
+
+  // Now attempt to do a read of more data than remains buffered
+  scoped_refptr<IOBuffer> buf(new IOBuffer(kLen33));
+  ASSERT_EQ(kLen3, sock_->Read(buf, kLen33, &read_callback_));
+  ASSERT_EQ(std::string(kMsg3, kLen3), std::string(buf->data(), kLen3));
+  ASSERT_TRUE(sock_->IsConnected());
+}
+
 TEST_F(SpdyProxyClientSocketTest, ReadAuthResponseBody) {
   scoped_ptr<spdy::SpdyFrame> conn(ConstructConnectRequestFrame());
   MockWrite writes[] = {