Remove lazy deletion of WeakPtrs in Http2PushPromiseIndex.

SpdySession closes all active streams before destruction, as documented
by DCHECK(active_streams_.empty()) in DcheckDraining() which is called
in the destructor.  This guarantees that UnclaimedPushedStreamContainer
will be empty by this time (because every entry in that container must
be an active stream), also that there will never be invalidated weak
pointers in Http2PushPromiseIndex (because every entry in that container
must also be in unclaimed_pushed_streams_ of the corresponding
SpdySession).  Therefore lazy deletion in Http2PushPromiseIndex never
happens.

Bug: 554220
Cq-Include-Trybots: master.tryserver.chromium.android:android_cronet_tester;master.tryserver.chromium.mac:ios-simulator-cronet
Change-Id: I4bb8c094af8212adcf39e8731698b562f184453e
Reviewed-on: https://chromium-review.googlesource.com/744506Reviewed-by: Helen Li <xunjieli@chromium.org>
Commit-Queue: Bence Béky <bnc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512822}

net/spdy/chromium/http2_push_promise_index.cc

@@ -29,11 +29,6 @@ base::WeakPtr<SpdySession> Http2PushPromiseIndex::Find(
   for (WeakSessionList::iterator it = url_it->second.begin();
        it != url_it->second.end();) {
     base::WeakPtr<SpdySession> spdy_session = *it;
-    // Lazy deletion of destroyed SpdySessions.
-    if (!spdy_session) {
-      it = url_it->second.erase(it);
-      continue;
-    }
     ++it;
     const SpdySessionKey& spdy_session_key = spdy_session->spdy_session_key();
     if (spdy_session_key.proxy_server() != key.proxy_server() ||
@@ -85,11 +80,6 @@ void Http2PushPromiseIndex::UnregisterUnclaimedPushedStream(
   size_t removed = 0;
   for (WeakSessionList::iterator it = url_it->second.begin();
        it != url_it->second.end();) {
-    // Lazy deletion of destroyed SpdySessions.
-    if (!*it) {
-      it = url_it->second.erase(it);
-      continue;
-    }
     if (it->get() == spdy_session) {
       it = url_it->second.erase(it);
       ++removed;

net/spdy/chromium/http2_push_promise_index.h

@@ -45,7 +45,8 @@ class NET_EXPORT Http2PushPromiseIndex {
   typedef std::map<GURL, WeakSessionList> UnclaimedPushedStreamMap;
 
   // A map of all SpdySessions owned by |this| that have an unclaimed pushed
-  // streams for a GURL.  Might contain invalid WeakPtr's.
+  // streams for a GURL.  SpdySession must unregister its streams before
+  // destruction, therefore all weak pointers must be valid.
   // A single SpdySession can only have at most one pushed stream for each GURL,
   // but it is possible that multiple SpdySessions have pushed streams for the
   // same GURL.