There is a racing between SyncSocket::Receive in audio_thread_ and SyncSocket::Close in renderer ...

content/renderer/media/audio_input_device.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Low-latency audio capturing unit utilizing audio input stream provided
 // by browser process through IPC.
 //
 // Relationship of classes:
 //
 //  AudioInputController                 AudioInputDevice
@@ skipping 152 matching lines @@
   void InitializeOnIOThread();
   void SetSessionIdOnIOThread(int session_id);
   void StartOnIOThread();
   void ShutDownOnIOThread(base::WaitableEvent* completion);
   void SetVolumeOnIOThread(double volume);
 
   void Send(IPC::Message* message);
 
   // Method called on the audio thread ----------------------------------------
   // Calls the client's callback for capturing audio.
-  void FireCaptureCallback();
+  void FireCaptureCallback(int16* input_audio);
 
   // DelegateSimpleThread::Delegate implementation.
   virtual void Run() OVERRIDE;
 
   // Format
   AudioParameters audio_parameters_;
 
   CaptureCallback* callback_;
   CaptureEventHandler* event_handler_;
 
   // The client callback receives captured audio here.
   std::vector<float*> audio_data_;
 
   // The client stores the last reported audio delay in this member.
   // The delay shall reflect the amount of audio which still resides in
   // the input buffer, i.e., the expected audio input delay.
   int audio_delay_milliseconds_;
 
   // The current volume scaling [0.0, 1.0] of the audio stream.
   double volume_;
 
   // Callbacks for capturing audio occur on this thread.
   scoped_ptr<base::DelegateSimpleThread> audio_thread_;
 
-  // IPC message stuff.
-  base::SharedMemory* shared_memory() { return shared_memory_.get(); }
-  base::SyncSocket* socket() { return socket_.get(); }
-  void* shared_memory_data() { return shared_memory()->memory(); }
-
   // Cached audio input message filter (lives on the main render thread).
   scoped_refptr<AudioInputMessageFilter> filter_;
 
   // Our stream ID on the message filter. Only modified on the IO thread.
   int32 stream_id_;
 
   // The media session ID used to identify which input device to be started.
   // Only modified on the IO thread.
   int session_id_;
 
   // State variable used to indicate it is waiting for a OnDeviceReady()
   // callback. Only modified on the IO thread.
   bool pending_device_ready_;
 
-  scoped_ptr<base::SharedMemory> shared_memory_;
-  scoped_ptr<base::SyncSocket> socket_;
+  base::SharedMemoryHandle shared_memory_handle_;
+  base::SyncSocket::Handle socket_handle_;
+  int memory_length_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(AudioInputDevice);
 };
 
 #endif  // CONTENT_RENDERER_MEDIA_AUDIO_INPUT_DEVICE_H_