tree a361fb2e0c050974bfb66dde95b667ae13c88817
parent 780013095e4ec34697ee4d77f9517bd0ab870638
author bnc <bnc@google.com> 1574126096 -0800
committer Copybara-Service <copybara-worker@google.com> 1574126139 -0800

Fix use-after-free in QpackProgressiveDecoder and QpackInstructionDecoder.

I locally verified that this fixes both https://crbug.com/1025158 and
https://crbug.com/1025209.

QpackDecodedHeadersAccumulator and QuicSpdyStream had a secret conference at
cl/280327626 where they agreed that QpackDecodedHeadersAccumulator will support
being destroyed by the handler and QuicSpdyStream can get much cleaner by
relying on it.  However, they forgot to tell QpackProgressiveDecoder and
QpackInstructionDecoder, who are now quite grumpy at https://crbug.com/1025209.

It is clear that these four do not talk, otherwise how could it happen that
QuicSpdyStream is the Visitor of QpackDecodedHeadersAccumulator,
QpackDecodedHeadersAccumulator is the Handler of QpackProgressiveDecoder,
and QpackProgressiveDecoder is the Delegate of QpackInstructionDecoder,
three different design pattern names for almost identical relationships.

gfe-relnote: n/a, change to QUIC v99-only code.  Protected by existing disabled gfe2_reloadable_flag_quic_enable_version_99.
PiperOrigin-RevId: 281188599
Change-Id: I63b5612c142e7f1fbe0bf05eb32ddf68457b4bc3