Avoids crash in PCMWaveInAudioInputStream::WaveCallback

media/audio/win/wavein_input_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/audio/win/wavein_input_win.h"
 
 #pragma comment(lib, "winmm.lib")
 
 #include "base/logging.h"
 #include "media/audio/audio_io.h"
@@ skipping 134 matching lines @@
 void PCMWaveInAudioInputStream::Stop() {
   if (state_ != kStateRecording)
     return;
   state_ = kStateStopping;
   // Wait for the callback to finish, it will signal us when ready to be reset.
   if (WAIT_OBJECT_0 !=
       ::WaitForSingleObject(stopped_event_, kStopInputStreamCallbackTimeout)) {
     HandleError(::GetLastError());
     return;
   }
+
   // Stop is always called before Close. In case of error, this will be
   // also called when closing the input controller.
   manager_->DecreaseActiveInputStreamCount();
 
   state_ = kStateStopped;
   MMRESULT res = ::waveInReset(wavein_);
   if (res != MMSYSERR_NOERROR) {
     state_ = kStateRecording;
     HandleError(res);
     return;
   }
+
+  // Wait for lock to ensure all outstanding callbacks have completed.
+  base::AutoLock auto_lock(lock_);
+
+  // Don't use callback after Stop().
+  callback_ = NULL;
+
   state_ = kStateReady;
 }
 
 // We can Close in any state except that when trying to close a stream that is
 // recording Windows generates an error, which we propagate to the source.
 void PCMWaveInAudioInputStream::Close() {
   if (wavein_) {
     // waveInClose generates a callback with WIM_CLOSE id in the same thread.
     MMRESULT res = ::waveInClose(wavein_);
     if (res != MMSYSERR_NOERROR) {
@@ skipping 82 matching lines @@
 }
 
 // Windows calls us back in this function when some events happen. Most notably
 // when it has an audio buffer with recorded data.
 void PCMWaveInAudioInputStream::WaveCallback(HWAVEIN hwi, UINT msg,
                                              DWORD_PTR instance,
                                              DWORD_PTR param1, DWORD_PTR) {
   PCMWaveInAudioInputStream* obj =
       reinterpret_cast<PCMWaveInAudioInputStream*>(instance);
 
+  // The lock ensures that Stop() can't be called during a callback.
+  base::AutoLock auto_lock(obj->lock_);
+
   if (msg == WIM_DATA) {
     // WIM_DONE indicates that the driver is done with our buffer. We pass it
     // to the callback and check if we need to stop playing.
     // It should be OK to assume the data in the buffer is what has been
     // recorded in the soundcard.
     // TODO(henrika): the |volume| parameter is always set to zero since there
     // is currently no support for controlling the microphone volume level.
     WAVEHDR* buffer = reinterpret_cast<WAVEHDR*>(param1);
-    obj->callback_->OnData(obj, reinterpret_cast<const uint8*>(buffer->lpData),
-                           buffer->dwBytesRecorded,
-                           buffer->dwBytesRecorded,
-                           0.0);
+    if (obj->callback_) {
+      obj->callback_->OnData(obj,
+                             reinterpret_cast<const uint8*>(buffer->lpData),
+                             buffer->dwBytesRecorded,
+                             buffer->dwBytesRecorded,
+                             0.0);
+    }
 
     if (obj->state_ == kStateStopping) {
       // The main thread has called Stop() and is waiting to issue waveOutReset
       // which will kill this thread. We should not enter AudioSourceCallback
       // code anymore.
       ::SetEvent(obj->stopped_event_);
     } else if (obj->state_ == kStateStopped) {
       // Not sure if ever hit this but just in case.
     } else {
       // Queue the finished buffer back with the audio driver. Since we are
       // reusing the same buffers we can get away without calling
       // waveInPrepareHeader.
       obj->QueueNextPacket(buffer);
     }
   } else if (msg == WIM_CLOSE) {
     // We can be closed before calling Start, so it is possible to have a
     // null callback at this point.
     if (obj->callback_)
       obj->callback_->OnClose(obj);
   }
 }
 
 }  // namespace media