commit d637672ffd93517a4e413b55dfb92121f25bf733
author wub <wub@google.com> Tue Dec 01 13:59:22 2020 -0800
committer Copybara-Service <copybara-worker@google.com> Tue Dec 01 14:00:02 2020 -0800
tree 737115d0721a988e3d7095e7f6b08fa996b3e8d5
parent 5a9959053ffba4c72d68a0f53b2d6aa8fa0b1504

Add a QUIC_BUG to detect double free of QuicStreamSequencer objects.

This is similar to the destruction_indicator removed in cl/204339592. It seems the memory bug around QuicStreamSequencerBuffer::~QuicStreamSequencerBuffer is still occurring in the wild.

PiperOrigin-RevId: 345094362
Change-Id: I69dec06bf863bfaee29f2a56648d560e9ea6b258

quic/core/quic_stream_sequencer.cc

diff --git a/quic/core/quic_stream_sequencer.cc b/quic/core/quic_stream_sequencer.cc
index 7d1c237..8f61264 100644
--- a/quic/core/quic_stream_sequencer.cc
+++ b/quic/core/quic_stream_sequencer.cc
@@ -22,6 +22,7 @@
 #include "net/third_party/quiche/src/quic/platform/api/quic_flag_utils.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_flags.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_logging.h"
+#include "net/third_party/quiche/src/quic/platform/api/quic_stack_trace.h"
 #include "net/third_party/quiche/src/common/platform/api/quiche_str_cat.h"
 
 namespace quic {
@@ -37,7 +38,13 @@
       ignore_read_data_(false),
       level_triggered_(false) {}
 
-QuicStreamSequencer::~QuicStreamSequencer() {}
+QuicStreamSequencer::~QuicStreamSequencer() {
+  if (stream_ == nullptr) {
+    QUIC_BUG << "Double free'ing QuicStreamSequencer at " << this << ". "
+             << QuicStackTrace();
+  }
+  stream_ = nullptr;
+}
 
 void QuicStreamSequencer::OnStreamFrame(const QuicStreamFrame& frame) {
   DCHECK_LE(frame.offset + frame.data_length, close_offset_);