Fix PendingPathRateLimiter to allow for a temp negative credit

Summary:
Taking jbeshay's idea of allowing up to one packet's worth of data to
go into "negative" credit instead of crashing.

Reviewed By: jbeshay, mjoras

Differential Revision: D54567844

fbshipit-source-id: 61d04ac6a4ac291f96d138d375bd5e149541be7e

quic/state/PendingPathRateLimiter.cpp

@@ -12,8 +12,12 @@
 namespace quic {
 
 void PendingPathRateLimiter::onPacketSent(uint64_t sentBytes) {
-  DCHECK_GE(credit_, sentBytes);
-  credit_ -= sentBytes;
+  // Allow for up to one packet's worth of data to go into "negative" credit.
+  if (sentBytes > credit_) {
+    credit_ = 0;
+  } else {
+    credit_ -= sentBytes;
+  }
 }
 
 uint64_t PendingPathRateLimiter::currentCredit(

quic/state/test/StateDataTest.cpp

@@ -288,5 +288,32 @@ TEST_F(PendingPathRateLimiterTest, TestCreditRefreshOnInfrequentSends) {
       maxWindowBytes);
 }
 
+TEST_F(PendingPathRateLimiterTest, TestOnPacketSentTooMuchData) {
+  EXPECT_EQ(
+      limiter_.currentCredit(now, std::chrono::microseconds{kRtt}),
+      maxWindowBytes);
+
+  limiter_.onPacketSent(12334583456456);
+  EXPECT_EQ(limiter_.currentCredit(now, std::chrono::microseconds{kRtt}), 0);
+}
+
+TEST_F(
+    PendingPathRateLimiterTest,
+    TestOnPacketSentTooMuchDataCreditRestoresAfterTime) {
+  EXPECT_EQ(
+      limiter_.currentCredit(now, std::chrono::microseconds{kRtt}),
+      maxWindowBytes);
+
+  limiter_.onPacketSent(12334583456456);
+  EXPECT_EQ(limiter_.currentCredit(now, std::chrono::microseconds{kRtt}), 0);
+
+  auto delta =
+      std::chrono::microseconds{kRtt} + std::chrono::microseconds{1000};
+  now += delta;
+  EXPECT_EQ(
+      limiter_.currentCredit(now, std::chrono::microseconds{kRtt}),
+      maxWindowBytes);
+}
+
 } // namespace test
 } // namespace quic