Fix cases where SpdySession can double-remove from the SpdySessionPool.

BUG=42229
TEST=SpdyNetworkTransactionTest.GoAwayWithActiveStream

Review URL: http://codereview.chromium.org/1747006

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@45447 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 17 insertions, 3 deletions

diff --git a/net/spdy/spdy_session.cc b/net/spdy/spdy_session.cc
index 64b944e..1d43a9f 100644
--- a/net/spdy/spdy_session.cc
+++ b/net/spdy/spdy_session.cc
@@ -210,7 +210,8 @@ SpdySession::SpdySession(const HostPortPair& host_port_pair,
       streams_initiated_count_(0),
       streams_pushed_count_(0),
       streams_pushed_and_claimed_count_(0),
-      streams_abandoned_count_(0) {
+      streams_abandoned_count_(0),
+      in_session_pool_(true) {
   // TODO(mbelshe): consider randomization of the stream_hi_water_mark.
 
   spdy_framer_.set_visitor(this);
@@ -803,7 +804,7 @@ void SpdySession::CloseSessionOnError(net::Error err) {
     state_ = CLOSED;
     error_ = err;
     CloseAllStreams(err);
-    session_->spdy_session_pool()->Remove(this);
+    RemoveFromPool();
   }
 }
 
@@ -830,6 +831,13 @@ void SpdySession::DeactivateStream(spdy::SpdyStreamId id) {
   active_streams_.erase(id);
 }
 
+void SpdySession::RemoveFromPool() {
+  if (in_session_pool_) {
+    session_->spdy_session_pool()->Remove(this);
+    in_session_pool_ = false;
+  }
+}
+
 scoped_refptr<SpdyStream> SpdySession::GetPushStream(const std::string& path) {
   static StatsCounter used_push_streams("spdy.claimed_push_streams");
 
@@ -1102,7 +1110,7 @@ void SpdySession::OnFin(const spdy::SpdyRstStreamControlFrame& frame) {
 void SpdySession::OnGoAway(const spdy::SpdyGoAwayControlFrame& frame) {
   LOG(INFO) << "Spdy GOAWAY for session[" << this << "] for " <<
       host_port_pair().ToString();
-  session_->spdy_session_pool()->Remove(this);
+  RemoveFromPool();
 
   // TODO(willchan): Cancel any streams that are past the GoAway frame's
   // |last_accepted_stream_id|.
diff --git a/net/spdy/spdy_session.h b/net/spdy/spdy_session.h
index 32d1d0c..de19186 100644
--- a/net/spdy/spdy_session.h
+++ b/net/spdy/spdy_session.h
@@ -157,6 +157,9 @@ class SpdySession : public base::RefCounted<SpdySession>,
   void ActivateStream(SpdyStream* stream);
   void DeactivateStream(spdy::SpdyStreamId id);
 
+  // Removes this session from the session pool.
+  void RemoveFromPool();
+
   // Check if we have a pending pushed-stream for this url
   // Returns the stream if found (and returns it from the pending
   // list), returns NULL otherwise.
@@ -240,6 +243,8 @@ class SpdySession : public base::RefCounted<SpdySession>,
   int streams_pushed_and_claimed_count_;
   int streams_abandoned_count_;
 
+  bool in_session_pool_;  // True if the session is currently in the pool.
+
   static bool use_ssl_;
 };
 
diff --git a/net/spdy/spdy_session_pool.cc b/net/spdy/spdy_session_pool.cc
index 1a1141f..15028f9 100644
--- a/net/spdy/spdy_session_pool.cc
+++ b/net/spdy/spdy_session_pool.cc
@@ -65,6 +65,7 @@ bool SpdySessionPool::HasSession(const HostPortPair& host_port_pair) const {
 
 void SpdySessionPool::Remove(const scoped_refptr<SpdySession>& session) {
   SpdySessionList* list = GetSessionList(session->host_port_pair());
+  DCHECK(list);  // We really shouldn't remove if we've already been removed.
   if (!list)
     return;
   list->remove(session);