Reland "Separate client and server pushed streams limits."

https://codereview.chromium.org/367963003/

Fix use-after-free error

BUG=170544, 377538
R=jgraettinger@chromium.org

TEST=SpdySessionTest.PushedStreamShouldNotCountToClientConcurrencyLimit
SpdySessionTest.RejectPushedStreamExceedingConcurrencyLimit
SpdySessionTest.IgnoreReservedRemoteStreamsCount

Review URL: https://codereview.chromium.org/371273003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@282889 0039d316-1c4b-4281-b951-d872f2087c98

net/spdy/spdy_session.cc

@@ -549,6 +549,8 @@ SpdySession::SpdySession(
       http_server_properties_(http_server_properties),
       read_buffer_(new IOBuffer(kReadBufferSize)),
       stream_hi_water_mark_(kFirstStreamId),
+      num_pushed_streams_(0u),
+      num_active_pushed_streams_(0u),
       in_flight_write_frame_type_(DATA),
       in_flight_write_frame_size_(0),
       is_secure_(false),
@@ -563,6 +565,7 @@ SpdySession::SpdySession(
       max_concurrent_streams_limit_(max_concurrent_streams_limit == 0
                                         ? kMaxConcurrentStreamLimit
                                         : max_concurrent_streams_limit),
+      max_concurrent_pushed_streams_(kMaxConcurrentPushedStreams),
       streams_initiated_count_(0),
       streams_pushed_count_(0),
       streams_pushed_and_claimed_count_(0),
@@ -777,7 +780,7 @@ int SpdySession::TryCreateStream(
     return err;
 
   if (!max_concurrent_streams_ ||
-      (active_streams_.size() + created_streams_.size() <
+      (active_streams_.size() + created_streams_.size() - num_pushed_streams_ <
        max_concurrent_streams_)) {
     return CreateStream(*request, stream);
   }
@@ -1218,8 +1221,12 @@ void SpdySession::CloseActiveStreamIterator(ActiveStreamMap::iterator it,
   // probably something that we still want to support, although server
   // push is hardly used. Write tests for this and fix this. (See
   // http://crbug.com/261712 .)
-  if (owned_stream->type() == SPDY_PUSH_STREAM)
+  if (owned_stream->type() == SPDY_PUSH_STREAM) {
     unclaimed_pushed_streams_.erase(owned_stream->url());
+    num_pushed_streams_--;
+    if (!owned_stream->IsReservedRemote())
+      num_active_pushed_streams_--;
+  }
 
   DeleteStream(owned_stream.Pass(), status);
   MaybeFinishGoingAway();
@@ -2095,6 +2102,23 @@ int SpdySession::OnInitialResponseHeadersReceived(
     SpdyStream* stream) {
   CHECK(in_io_loop_);
   SpdyStreamId stream_id = stream->stream_id();
+
+  if (stream->type() == SPDY_PUSH_STREAM) {
+    DCHECK(stream->IsReservedRemote());
+    if (max_concurrent_pushed_streams_ &&
+        num_active_pushed_streams_ >= max_concurrent_pushed_streams_) {
+      ResetStream(stream_id,
+                  RST_STREAM_REFUSED_STREAM,
+                  "Stream concurrency limit reached.");
+      return STATUS_CODE_REFUSED_STREAM;
+    }
+  }
+
+  if (stream->type() == SPDY_PUSH_STREAM) {
+    // Will be balanced in DeleteStream.
+    num_active_pushed_streams_++;
+  }
+
   // May invalidate |stream|.
   int rv = stream->OnInitialResponseHeadersReceived(
       response_headers, response_time, recv_first_byte_time);
@@ -2102,6 +2126,7 @@ int SpdySession::OnInitialResponseHeadersReceived(
     DCHECK_NE(rv, ERR_IO_PENDING);
     DCHECK(active_streams_.find(stream_id) == active_streams_.end());
   }
+
   return rv;
 }
 
@@ -2584,6 +2609,7 @@ bool SpdySession::TryCreatePushStream(SpdyStreamId stream_id,
 
   active_it->second.stream->OnPushPromiseHeadersReceived(headers);
   DCHECK(active_it->second.stream->IsReservedRemote());
+  num_pushed_streams_++;
   return true;
 }
 

net/spdy/spdy_session.h

@@ -427,10 +427,15 @@ class NET_EXPORT SpdySession : public BufferedSpdyFramerVisitorInterface,
   // available for testing and diagnostics.
   size_t num_active_streams() const { return active_streams_.size(); }
   size_t num_unclaimed_pushed_streams() const {
-      return unclaimed_pushed_streams_.size();
+    return unclaimed_pushed_streams_.size();
   }
   size_t num_created_streams() const { return created_streams_.size(); }
 
+  size_t num_pushed_streams() const { return num_pushed_streams_; }
+  size_t num_active_pushed_streams() const {
+    return num_active_pushed_streams_;
+  }
+
   size_t pending_create_stream_queue_size(RequestPriority priority) const {
     DCHECK_GE(priority, MINIMUM_PRIORITY);
     DCHECK_LE(priority, MAXIMUM_PRIORITY);
@@ -526,6 +531,11 @@ class NET_EXPORT SpdySession : public BufferedSpdyFramerVisitorInterface,
   FRIEND_TEST_ALL_PREFIXES(SpdySessionTest, StreamIdSpaceExhausted);
   FRIEND_TEST_ALL_PREFIXES(SpdySessionTest, UnstallRacesWithStreamCreation);
   FRIEND_TEST_ALL_PREFIXES(SpdySessionTest, GoAwayOnSessionFlowControlError);
+  FRIEND_TEST_ALL_PREFIXES(SpdySessionTest,
+                           RejectPushedStreamExceedingConcurrencyLimit);
+  FRIEND_TEST_ALL_PREFIXES(SpdySessionTest, IgnoreReservedRemoteStreamsCount);
+  FRIEND_TEST_ALL_PREFIXES(SpdySessionTest,
+                           CancelReservedStreamOnHeadersReceived);
 
   typedef std::deque<base::WeakPtr<SpdyStreamRequest> >
       PendingStreamRequestQueue;
@@ -919,6 +929,10 @@ class NET_EXPORT SpdySession : public BufferedSpdyFramerVisitorInterface,
     hung_interval_ = duration;
   }
 
+  void set_max_concurrent_pushed_streams(size_t value) {
+    max_concurrent_pushed_streams_ = value;
+  }
+
   int64 pings_in_flight() const { return pings_in_flight_; }
 
   uint32 next_ping_id() const { return next_ping_id_; }
@@ -984,6 +998,16 @@ class NET_EXPORT SpdySession : public BufferedSpdyFramerVisitorInterface,
   // |created_streams_| owns all its SpdyStream objects.
   CreatedStreamSet created_streams_;
 
+  // Number of pushed streams. All active streams are stored in
+  // |active_streams_|, but it's better to know the number of push streams
+  // without traversing the whole collection.
+  size_t num_pushed_streams_;
+
+  // Number of active pushed streams in |active_streams_|, i.e. not in reserved
+  // remote state. Streams in reserved state are not counted towards any
+  // concurrency limits.
+  size_t num_active_pushed_streams_;
+
   // The write queue.
   SpdyWriteQueue write_queue_;
 
@@ -1022,6 +1046,7 @@ class NET_EXPORT SpdySession : public BufferedSpdyFramerVisitorInterface,
   // Limits
   size_t max_concurrent_streams_;  // 0 if no limit
   size_t max_concurrent_streams_limit_;
+  size_t max_concurrent_pushed_streams_;
 
   // Some statistics counters for the session.
   int streams_initiated_count_;

net/spdy/spdy_stream_test_util.cc

@@ -141,6 +141,21 @@ void StreamDelegateWithBody::OnRequestHeadersSent() {
   stream()->SendData(buf_.get(), buf_->size(), NO_MORE_DATA_TO_SEND);
 }
 
+StreamDelegateCloseOnHeaders::StreamDelegateCloseOnHeaders(
+    const base::WeakPtr<SpdyStream>& stream)
+    : StreamDelegateBase(stream) {
+}
+
+StreamDelegateCloseOnHeaders::~StreamDelegateCloseOnHeaders() {
+}
+
+SpdyResponseHeadersStatus
+StreamDelegateCloseOnHeaders::OnResponseHeadersUpdated(
+    const SpdyHeaderBlock& response_headers) {
+  stream()->Cancel();
+  return RESPONSE_HEADERS_ARE_COMPLETE;
+}
+
 } // namespace test
 
 } // namespace net

net/spdy/spdy_stream_test_util.h

@@ -120,6 +120,16 @@ class StreamDelegateWithBody : public StreamDelegateBase {
   scoped_refptr<StringIOBuffer> buf_;
 };
 
+// Test delegate that closes stream in OnResponseHeadersUpdated().
+class StreamDelegateCloseOnHeaders : public StreamDelegateBase {
+ public:
+  StreamDelegateCloseOnHeaders(const base::WeakPtr<SpdyStream>& stream);
+  virtual ~StreamDelegateCloseOnHeaders();
+
+  virtual SpdyResponseHeadersStatus OnResponseHeadersUpdated(
+      const SpdyHeaderBlock& response_headers) OVERRIDE;
+};
+
 } // namespace test
 
 } // namespace net