bug 756551 part 2 verify state of spdy mNeedsCleanup stream r=honzab

netwerk/protocol/http/SpdySession.cpp

@@ -1708,6 +1708,11 @@ SpdySession::WriteSegments(nsAHttpSegmentWriter *writer,
   if (mDownstreamState == PROCESSING_DATA_FRAME ||
       mDownstreamState == PROCESSING_CONTROL_SYN_REPLY) {
 
+    // The cleanup stream should only be set while stream->WriteSegments is
+    // on the stack and then cleaned up in this code block afterwards.
+    NS_ABORT_IF_FALSE(!mNeedsCleanup, "cleanup stream set unexpectedly");
+    mNeedsCleanup = nsnull;                     /* just in case */
+
     mSegmentWriter = writer;
     rv = mInputFrameDataStream->WriteSegments(this, count, countWritten);
     mSegmentWriter = nsnull;
@@ -1727,6 +1732,7 @@ SpdySession::WriteSegments(nsAHttpSegmentWriter *writer,
             mNeedsCleanup));
       CleanupStream(stream, NS_OK, RST_CANCEL);
       NS_ABORT_IF_FALSE(!mNeedsCleanup, "double cleanup out of data frame");
+      mNeedsCleanup = nsnull;                     /* just in case */
       return NS_OK;
     }