Fix potential thread safety issue on ScriptProcessNdoe during fire onaudioprocess eventhandler.

Source/modules/webaudio/ScriptProcessorNode.cpp

 /*
  * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 75 matching lines @@
 
     return adoptRef(new ScriptProcessorNode(context, sampleRate, bufferSize, numberOfInputChannels, numberOfOutputChannels));
 }
 
 ScriptProcessorNode::ScriptProcessorNode(AudioContext* context, float sampleRate, size_t bufferSize, unsigned numberOfInputChannels, unsigned numberOfOutputChannels)
     : AudioNode(context, sampleRate)
     , m_doubleBufferIndex(0)
     , m_doubleBufferIndexForEvent(0)
     , m_bufferSize(bufferSize)
     , m_bufferReadWriteIndex(0)
-    , m_isRequestOutstanding(false)
     , m_numberOfInputChannels(numberOfInputChannels)
     , m_numberOfOutputChannels(numberOfOutputChannels)
     , m_internalInputBus(AudioBus::create(numberOfInputChannels, AudioNode::ProcessingSizeInFrames, false))
 {
     ScriptWrappable::init(this);
     // Regardless of the allowed buffer sizes, we still need to process at the granularity of the AudioNode.
     if (m_bufferSize < AudioNode::ProcessingSizeInFrames)
         m_bufferSize = AudioNode::ProcessingSizeInFrames;
 
     ASSERT(numberOfInputChannels <= AudioContext::maxNumberOfChannels());
@@ skipping 100 matching lines @@
         memcpy(outputBus->channel(i)->mutableData(), outputBuffer->getChannelData(i)->data() + m_bufferReadWriteIndex, sizeof(float) * framesToProcess);
 
     // Update the buffering index.
     m_bufferReadWriteIndex = (m_bufferReadWriteIndex + framesToProcess) % bufferSize();
 
     // m_bufferReadWriteIndex will wrap back around to 0 when the current input and output buffers are full.
     // When this happens, fire an event and swap buffers.
     if (!m_bufferReadWriteIndex) {
         // Avoid building up requests on the main thread to fire process events when they're not being handled.
         // This could be a problem if the main thread is very busy doing other things and is being held up handling previous requests.
-        if (m_isRequestOutstanding) {
+        // The audio thread can't block on this lock, so we call tryLock() instead.
+        MutexTryLocker tryLocker(m_processEventLock);
+        if (!tryLocker.locked()) {
             // We're late in handling the previous request. The main thread must be very busy.
             // The best we can do is clear out the buffer ourself here.
             outputBuffer->zero();
         } else {
             // Reference ourself so we don't accidentally get deleted before fireProcessEvent() gets called.
             ref();
 
             // Fire the event on the main thread, not this one (which is the realtime audio thread).
             m_doubleBufferIndexForEvent = m_doubleBufferIndex;
-            m_isRequestOutstanding = true;
             callOnMainThread(fireProcessEventDispatch, this);
         }
 
         swapBuffers();
     }
 }
 
 void ScriptProcessorNode::fireProcessEventDispatch(void* userData)
 {
     ScriptProcessorNode* jsAudioNode = static_cast<ScriptProcessorNode*>(userData);
     ASSERT(jsAudioNode);
     if (!jsAudioNode)
         return;
 
     jsAudioNode->fireProcessEvent();
 
     // De-reference to match the ref() call in process().
     jsAudioNode->deref();
 }
 
 void ScriptProcessorNode::fireProcessEvent()
 {
-    ASSERT(isMainThread() && m_isRequestOutstanding);
+    ASSERT(isMainThread());
 
     bool isIndexGood = m_doubleBufferIndexForEvent < 2;
     ASSERT(isIndexGood);
     if (!isIndexGood)
         return;
 
     AudioBuffer* inputBuffer = m_inputBuffers[m_doubleBufferIndexForEvent].get();
     AudioBuffer* outputBuffer = m_outputBuffers[m_doubleBufferIndexForEvent].get();
     ASSERT(outputBuffer);
     if (!outputBuffer)
         return;
 
     // Avoid firing the event if the document has already gone away.
     if (context()->executionContext()) {
-        // Let the audio thread know we've gotten to the point where it's OK for it to make another request.
-        m_isRequestOutstanding = false;
+        // This synchronizes with process().
+        MutexLocker processLocker(m_processEventLock);
 
         // Call the JavaScript event handler which will do the audio processing.
         dispatchEvent(AudioProcessingEvent::create(inputBuffer, outputBuffer));
     }
 }
 
 double ScriptProcessorNode::tailTime() const
 {
     return std::numeric_limits<double>::infinity();
 }
 
 double ScriptProcessorNode::latencyTime() const
 {
     return std::numeric_limits<double>::infinity();
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(WEB_AUDIO)