There is a racing between SyncSocket::Receive in audio_thread_ and SyncSocket::Close in renderer ...

content/renderer/media/audio_device.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/media/audio_device.h"
 
 #include "base/bind.h"
 #include "base/debug/trace_event.h"
 #include "base/message_loop.h"
 #include "base/time.h"
 #include "content/common/child_process.h"
 #include "content/common/media/audio_messages.h"
 #include "content/common/view_messages.h"
 #include "content/renderer/render_thread_impl.h"
 #include "media/audio/audio_util.h"
 
 AudioDevice::AudioDevice(size_t buffer_size,
                          int channels,
                          double sample_rate,
                          RenderCallback* callback)
     : buffer_size_(buffer_size),
       channels_(channels),
       bits_per_sample_(16),
       sample_rate_(sample_rate),
       callback_(callback),
       audio_delay_milliseconds_(0),
       volume_(1.0),
-      stream_id_(0) {
+      stream_id_(0),
+      memory_length_(0) {
   filter_ = RenderThreadImpl::current()->audio_message_filter();
   audio_data_.reserve(channels);
   for (int i = 0; i < channels; ++i) {
     float* channel_data = new float[buffer_size];
     audio_data_.push_back(channel_data);
   }
 }
 
 AudioDevice::~AudioDevice() {
   // The current design requires that the user calls Stop() before deleting
@@ skipping 10 matching lines @@
   params.sample_rate = static_cast<int>(sample_rate_);
   params.bits_per_sample = bits_per_sample_;
   params.samples_per_packet = buffer_size_;
 
   ChildProcess::current()->io_message_loop()->PostTask(
       FROM_HERE,
       base::Bind(&AudioDevice::InitializeOnIOThread, this, params));
 }
 
 bool AudioDevice::Stop() {
+  DCHECK(MessageLoop::current() != ChildProcess::current()->io_message_loop());
   // Max waiting time for Stop() to complete. If this time limit is passed,
   // we will stop waiting and return false. It ensures that Stop() can't block
   // the calling thread forever.
   const base::TimeDelta kMaxTimeOut = base::TimeDelta::FromMilliseconds(1000);
 
   base::WaitableEvent completion(false, false);
 
   ChildProcess::current()->io_message_loop()->PostTask(
       FROM_HERE,
       base::Bind(&AudioDevice::ShutDownOnIOThread, this, &completion));
 
   // We wait here for the IO task to be completed to remove race conflicts
   // with OnLowLatencyCreated() and to ensure that Stop() acts as a synchronous
   // function call.
-  if (completion.TimedWait(kMaxTimeOut)) {
-    if (audio_thread_.get()) {
-      socket_->Close();
-      audio_thread_->Join();
-      audio_thread_.reset(NULL);
+  if (!completion.TimedWait(kMaxTimeOut)) {
+    LOG(WARNING) << "Failed to shut down audio output on IO thread";

[tommi (sloooow) - chröme, 2011/12/01 14:40:45]

LOG(ERROR)?

[no longer working on chromium, 2011/12/02 10:16:30]

Done.

+  }
+
+  if (audio_thread_.get()) {
+    {
+      base::SyncSocket socket(socket_handle_);

[henrika (OOO until Aug 14), 2011/12/01 14:57:13]

A comment perhaps?

[no longer working on chromium, 2011/12/02 10:16:30]

Done.

     }
-  } else {
-    LOG(ERROR) << "Failed to shut down audio output on IO thread";
-    return false;
+    audio_thread_->Join();
+    audio_thread_.reset(NULL);
   }
 
   return true;

[Ami GONE FROM CHROMIUM, 2011/12/01 17:25:28]

FWIW, this function can't return false anymore after your change; change its
signature?

[no longer working on chromium, 2011/12/02 10:16:30]

Done.

 }
 
 bool AudioDevice::SetVolume(double volume) {
   if (volume < 0 || volume > 1.0)
     return false;
 
   ChildProcess::current()->io_message_loop()->PostTask(
       FROM_HERE,
       base::Bind(&AudioDevice::SetVolumeOnIOThread, this, volume));
 
@@ skipping 74 matching lines @@
   DCHECK(length);
 
   // Takes care of the case when Stop() is called before OnLowLatencyCreated().
   if (!stream_id_) {
     base::SharedMemory::CloseHandle(handle);
     // Close the socket handler.
     base::SyncSocket socket(socket_handle);
     return;
   }
 
-  shared_memory_.reset(new base::SharedMemory(handle, false));
-  shared_memory_->Map(length);
+  shared_memory_handle_ = handle;
+  memory_length_ = length;
 
   DCHECK_GE(length, buffer_size_ * sizeof(int16) * channels_);
 
-  socket_.reset(new base::SyncSocket(socket_handle));
-  // Allow the client to pre-populate the buffer.
-  FireRenderCallback();
+  socket_handle_ = socket_handle;
 
   audio_thread_.reset(

[tommi (sloooow) - chröme, 2011/12/01 14:40:45]

maybe we should dcheck at the top that the audio thread doesn't already exist.

[no longer working on chromium, 2011/12/02 10:16:30]

Done.

       new base::DelegateSimpleThread(this, "renderer_audio_thread"));
   audio_thread_->Start();
 
   MessageLoop::current()->PostTask(
       FROM_HERE,
       base::Bind(&AudioDevice::StartOnIOThread, this));
 }
 
 void AudioDevice::OnVolume(double volume) {
   NOTIMPLEMENTED();
 }
 
 void AudioDevice::Send(IPC::Message* message) {
   filter_->Send(message);
 }
 
 // Our audio thread runs here.
 void AudioDevice::Run() {
   audio_thread_->SetThreadPriority(base::kThreadPriority_RealtimeAudio);
 
+  base::SharedMemory shared_memory(shared_memory_handle_, false);
+  shared_memory.Map(memory_length_);
+  // Allow the client to pre-populate the buffer.
+  FireRenderCallback(static_cast<int16*>(shared_memory.memory()));

[tommi (sloooow) - chröme, 2011/12/01 14:40:45]

reinterpret_cast?

[no longer working on chromium, 2011/12/02 10:16:30]

Done.

+
+  base::SyncSocket socket(socket_handle_);
+
   int pending_data;
   const int samples_per_ms = static_cast<int>(sample_rate_) / 1000;
   const int bytes_per_ms = channels_ * (bits_per_sample_ / 8) * samples_per_ms;
 
-  while ((sizeof(pending_data) == socket_->Receive(&pending_data,
-                                                   sizeof(pending_data))) &&
+  while ((sizeof(pending_data) == socket.Receive(&pending_data,
+                                                 sizeof(pending_data))) &&
          (pending_data >= 0)) {
     // Convert the number of pending bytes in the render buffer
     // into milliseconds.
     audio_delay_milliseconds_ = pending_data / bytes_per_ms;
-    FireRenderCallback();
+    FireRenderCallback(static_cast<int16*>(shared_memory.memory()));

[tommi (sloooow) - chröme, 2011/12/01 14:40:45]

same here

[no longer working on chromium, 2011/12/02 10:16:30]

Done.

   }
 }
 
-void AudioDevice::FireRenderCallback() {
+void AudioDevice::FireRenderCallback(int16* data) {
   TRACE_EVENT0("audio", "AudioDevice::FireRenderCallback");
 
   if (callback_) {
     // Update the audio-delay measurement then ask client to render audio.
     callback_->Render(audio_data_, buffer_size_, audio_delay_milliseconds_);
 
     // Interleave, scale, and clip to int16.
     media::InterleaveFloatToInt16(audio_data_,
-                                  static_cast<int16*>(shared_memory_data()),
+                                  data,
                                   buffer_size_);
   }
 }