Code:  void SpdyWriteQueue::Clear() {
   CHECK(!removing_writes_);
   removing_writes_ = true;
   for (int i = MINIMUM_PRIORITY; i <= MAXIMUM_PRIORITY; ++i) {
     for (std::deque<PendingWrite>::iterator it = queue_[i].begin();
          it != queue_[i].end(); ++it) {
      delete it->frame_producer;
     }
     queue_[i].clear();
   }
   removing_writes_ = false;
 }

Vulnerability Type: DoS 
CWE ID: 
Summary: net/spdy/spdy_write_queue.cc in the SPDY implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging incorrect queue maintenance.
Commit Message: These can post callbacks which re-enter into SpdyWriteQueue.

BUG=369539

Review URL: https://codereview.chromium.org/265933007

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@268730 0039d316-1c4b-4281-b951-d872f2087c98