--- a/netwerk/protocol/http/SpdySession.cpp
+++ b/netwerk/protocol/http/SpdySession.cpp
@@ -1703,16 +1703,21 @@ SpdySession::WriteSegments(nsAHttpSegmen
           stream ? stream->StreamID() : 0));
     CleanupStream(stream, rv, RST_CANCEL);
     return NS_OK;
   }
 
   if (mDownstreamState == PROCESSING_DATA_FRAME ||
       mDownstreamState == PROCESSING_CONTROL_SYN_REPLY) {
 
+    // The cleanup stream should only be set while stream->WriteSegments is
+    // on the stack and then cleaned up in this code block afterwards.
+    NS_ABORT_IF_FALSE(!mNeedsCleanup, "cleanup stream set unexpectedly");
+    mNeedsCleanup = nsnull;                     /* just in case */
+
     mSegmentWriter = writer;
     rv = mInputFrameDataStream->WriteSegments(this, count, countWritten);
     mSegmentWriter = nsnull;
 
     mLastDataReadEpoch = mLastReadEpoch;
 
     if (rv == NS_BASE_STREAM_CLOSED) {
       // This will happen when the transaction figures out it is EOF, generally
@@ -1722,16 +1727,17 @@ SpdySession::WriteSegments(nsAHttpSegmen
         ResetDownstreamState();
       LOG3(("SpdySession::WriteSegments session=%p stream=%p 0x%X "
             "needscleanup=%p. cleanup stream based on "
             "stream->writeSegments returning BASE_STREAM_CLOSED\n",
             this, stream, stream ? stream->StreamID() : 0,
             mNeedsCleanup));
       CleanupStream(stream, NS_OK, RST_CANCEL);
       NS_ABORT_IF_FALSE(!mNeedsCleanup, "double cleanup out of data frame");
+      mNeedsCleanup = nsnull;                     /* just in case */
       return NS_OK;
     }
     
     if (mNeedsCleanup) {
       LOG3(("SpdySession::WriteSegments session=%p stream=%p 0x%X "
             "cleanup stream based on mNeedsCleanup.\n",
             this, mNeedsCleanup, mNeedsCleanup ? mNeedsCleanup->StreamID() : 0));
       CleanupStream(mNeedsCleanup, NS_OK, RST_CANCEL);