diff --git a/net/spdy/spdy_session.cc b/net/spdy/spdy_session.cc index 8be915620b48c..e99ec1422d97e 100644 --- a/net/spdy/spdy_session.cc +++ b/net/spdy/spdy_session.cc @@ -1887,6 +1887,15 @@ void SpdySession::ResetStreamIterator(ActiveStreamMap::iterator it, RequestPriority priority = it->second->priority(); EnqueueResetStreamFrame(stream_id, priority, error_code, description); + // EnqueueResetStreamFrame() can synchronously call DoDrainSession() -> + // StartGoingAway() -> CloseActiveStreamIterator(), which erases entries + // from |active_streams_| and invalidates |it|. Re-look-up the stream by + // ID; if it was already closed by the drain, there is nothing left to do. + it = active_streams_.find(stream_id); + if (it == active_streams_.end()) { + return; + } + // Removes any pending writes for the stream except for possibly an // in-flight one. CloseActiveStreamIterator(it, error);