# Reproduce: SpdyStream::IncreaseRecvWindowSize use-after-free

Tested on commit `effccce563102fd8315819caf7677f68394be7af`.

## Setup

Generate a TLS certificate (or use the provided ones):

```
openssl req -x509 -newkey rsa:2048 -keyout spdy_poc_key.pem -out spdy_poc_cert.pem -days 365 -nodes -subj "/CN=localhost"
```

Install the Python `h2` and `hpack` packages:

```
pip3 install h2 hpack
```

## Build

```
autoninja -C ~/chromium/src/out/asan-release chrome
```

## Run

Start the malicious HTTP/2 server:

```
python3 server.py
```

In a separate terminal, launch Chrome. The field trial lowers the capped-frame limit from 10000 to 100 for deterministic reproduction; the bug exists at any limit value.

```
ASAN_OPTIONS=detect_odr_violation=0 ~/chromium/src/out/asan-release/chrome \
  --no-sandbox --disable-gpu --ignore-certificate-errors \
  --user-data-dir=/tmp/poc-$(date +%s) \
  --headless=new \
  --force-fieldtrials=HTTP2/Experiment/ \
  --force-fieldtrial-params="HTTP2.Experiment:spdy_session_max_queued_capped_frames/100" \
  https://localhost:8443/
```

The Network Service IO thread crashes with a heap-use-after-free within approximately 8 seconds.