[WebSocket] Fix the crash when OnAddChannelResponse failed.

This CL fixes the crash if mojo creation in OnAddChannelResponse failed,
then we call WebSocket::Reset(), which deletes WebSocketChannel but it
tries to call instance methods after that.

To fix that, this CL unifies WebSocket::WebSocketEventHandler
::OnAddChannelResponse and ::AddSendFlowControlQuota for quota
initialize.

Fixed: 1018432
Change-Id: I197a15c07e23b04284713e67fca2dfcd92f01e1a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1883450Reviewed-by: Adam Rice <ricea@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Commit-Queue: Yoichi Osato <yoichio@chromium.org>
Cr-Commit-Position: refs/heads/master@{#710638}

net/websockets/websocket_channel.cc

@@ -465,18 +465,16 @@ void WebSocketChannel::OnConnectSuccess(
 
   SetState(CONNECTED);
 
-  event_interface_->OnAddChannelResponse(stream_->GetSubProtocol(),
-                                         stream_->GetExtensions());
+  // |stream_request_| is not used once the connection has succeeded.
+  stream_request_.reset();
 
   // TODO(ricea): Get flow control information from the WebSocketStream once we
   // have a multiplexing WebSocketStream.
   current_send_quota_ = send_quota_high_water_mark_;
-  event_interface_->OnSendFlowControlQuotaAdded(send_quota_high_water_mark_);
-
-  // |stream_request_| is not used once the connection has succeeded.
-  stream_request_.reset();
-
-  // |this| may have been deleted.
+  event_interface_->OnAddChannelResponse(stream_->GetSubProtocol(),
+                                         stream_->GetExtensions(),
+                                         send_quota_high_water_mark_);
+  // |this| may have been deleted after OnAddChannelResponse.
 }
 
 void WebSocketChannel::OnConnectFailure(const std::string& message) {

net/websockets/websocket_end_to_end_test.cc

@@ -97,7 +97,8 @@ class ConnectTestingEventInterface : public WebSocketEventInterface {
   void OnCreateURLRequest(URLRequest* request) override {}
 
   void OnAddChannelResponse(const std::string& selected_subprotocol,
-                            const std::string& extensions) override;
+                            const std::string& extensions,
+                            int64_t send_flow_control_quota) override;
 
   void OnDataFrame(bool fin,
                    WebSocketMessageType type,
@@ -168,7 +169,8 @@ std::string ConnectTestingEventInterface::extensions() const {
 
 void ConnectTestingEventInterface::OnAddChannelResponse(
     const std::string& selected_subprotocol,
-    const std::string& extensions) {
+    const std::string& extensions,
+    int64_t send_flow_control_quota) {
   selected_subprotocol_ = selected_subprotocol;
   extensions_ = extensions;
   QuitNestedEventLoop();

net/websockets/websocket_event_interface.h

@@ -46,7 +46,8 @@ class NET_EXPORT WebSocketEventInterface {
   // Called in response to an AddChannelRequest. This means that a response has
   // been received from the remote server.
   virtual void OnAddChannelResponse(const std::string& selected_subprotocol,
-                                    const std::string& extensions) = 0;
+                                    const std::string& extensions,
+                                    int64_t send_flow_control_quota) = 0;
 
   // Called when a data frame has been received from the remote host and needs
   // to be forwarded to the renderer process.

services/network/websocket.cc

@@ -86,7 +86,8 @@ class WebSocket::WebSocketEventHandler final
 
   void OnCreateURLRequest(net::URLRequest* url_request) override;
   void OnAddChannelResponse(const std::string& selected_subprotocol,
-                            const std::string& extensions) override;
+                            const std::string& extensions,
+                            int64_t send_flow_control_quota) override;
   void OnDataFrame(bool fin,
                    WebSocketMessageType type,
                    base::span<const char> payload) override;
@@ -142,7 +143,8 @@ void WebSocket::WebSocketEventHandler::OnCreateURLRequest(
 
 void WebSocket::WebSocketEventHandler::OnAddChannelResponse(
     const std::string& selected_protocol,
-    const std::string& extensions) {
+    const std::string& extensions,
+    int64_t send_flow_control_quota) {
   DVLOG(3) << "WebSocketEventHandler::OnAddChannelResponse @"
            << reinterpret_cast<void*>(this) << " selected_protocol=\""
            << selected_protocol << "\""
@@ -192,6 +194,8 @@ void WebSocket::WebSocketEventHandler::OnAddChannelResponse(
   impl_->header_client_.reset();
   impl_->client_.set_disconnect_handler(base::BindOnce(
       &WebSocket::OnConnectionError, base::Unretained(impl_), FROM_HERE));
+
+  impl_->client_->AddSendFlowControlQuota(send_flow_control_quota);
 }
 
 void WebSocket::WebSocketEventHandler::OnDataFrame(