Example URL:

Steps to reproduce the problem:
1. Continually starting engine sending requests and shutdown engine
2. Change network type from WiFi to 4G at the same time
3. Occasionally observed a crash for the dcheck

What is the expected behavior?

What went wrong?
The stack of the crash is (in brev): 
                            net::SpdySession::DcheckDraining() 
                            net::SpdySession::~SpdySession() 
                            net::SpdySession::RemoveUnavailableSession() 
                            net::SpdySessionPool::~SpdySessionPool() 
                            net::HttpNetworkSession::~HttpNetworkSession() 
                                                          .... 

I read some code, and I think the root cause is as follows: 
    1. In SpdySessionPool::OnIPAddressChanged, the sessions will be marked as GOAWAY instead of DRAINING because of the Marcos： #if defined(OS_ANDROID) || defined(OS_WIN) || defined(OS_IOS) 
    2. Next, the engine is stopped, and the SpdySessionPool is destructed 
    3. Although CloseAllSessions() will be called, previous sessions will not be closed because available_sessions_ is empty 
    4. RemoveUnavailableSession will destroy all managed SpdySessions 
    5. The SpdySessions marked as GOAWAY will cause the crash. 

I append some log to analysis  about SpdySessionPool::OnIPAddressChanged: 

// For OSs that terminate TCP connections upon relevant network changes, 
// attempt to preserve active streams by marking all sessions as going 
// away, rather than explicitly closing them. Streams may still fail due 
// to a generated TCP reset. 
#if defined(OS_ANDROID) || defined(OS_WIN) || defined(OS_IOS) 
    (*it)->MakeUnavailable(); 
    (*it)->StartGoingAway(kLastStreamId, ERR_NETWORK_CHANGED); 
    (*it)->MaybeFinishGoingAway(); 
#else 
    (*it)->CloseSessionOnError(ERR_NETWORK_CHANGED, 
                               "Closing current sessions."); 
    DCHECK((*it)->IsDraining()); 
#endif  // defined(OS_ANDROID) || defined(OS_WIN) || defined(OS_IOS) 
    DCHECK(!IsSessionAvailable(*it)); 
  } 

If there is a request alive when network changing, then: 

The comments point that active streams is preserved. SpdySession::StartGoingAway will clean all streams whose Id > (0x7FFFFFFF + 1), which means no active stream will be cleaned. So DoDrainSession() will not be called. 

If the request is failed (by application cancel in my case), then the engine is shutdown. The preserved active stream will cause this crash. I think this might be a bug. 

Besides， is there anyone can help to explain why the active streams is preserved? 

If the connection is changed, what are these GOINGAWAY streams used for? 

Did this work before? N/A 

Chrome version: <Copy from: 'about:version'>  Channel: n/a
OS Version: 
Flash Version: 

see https://groups.google.com/a/chromium.org/forum/#!mydiscussions/net-dev/-KaRDlLYJ3Q