Add back RenderFrameHost sanity-check to AudioRendererHost.

content/browser/renderer_host/media/audio_renderer_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/media/audio_renderer_host.h"
 
 #include <stdint.h>
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/lazy_instance.h"
-#include "base/logging.h"
 #include "base/memory/shared_memory.h"
 #include "base/metrics/histogram.h"
 #include "base/process/process.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/media/audio_stream_monitor.h"
 #include "content/browser/media/capture/audio_mirroring_manager.h"
 #include "content/browser/media/media_internals.h"
 #include "content/browser/renderer_host/media/audio_input_device_manager.h"
 #include "content/browser/renderer_host/media/audio_sync_reader.h"
@@ skipping 85 matching lines @@
     *params = media::AudioParameters::UnavailableDeviceParams();
 }
 
 void UMALogDeviceAuthorizationTime(base::TimeTicks auth_start_time) {
   UMA_HISTOGRAM_CUSTOM_TIMES("Media.Audio.OutputDeviceAuthorizationTime",
                               base::TimeTicks::Now() - auth_start_time,
                               base::TimeDelta::FromMilliseconds(1),
                               base::TimeDelta::FromMilliseconds(5000), 50);
 }
 
+#if DCHECK_IS_ON()
+// Check that the routing ID references a valid RenderFrameHost, and run
+// |callback| on the IO thread with true if the ID is valid.
+void ValidateRenderFrameId(int render_process_id,
+                           int render_frame_id,
+                           const base::Callback<void(bool)>& callback) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  const bool frame_exists =
+      !!RenderFrameHost::FromID(render_process_id, render_frame_id);
+  BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
+                          base::Bind(callback, frame_exists));
+}
+#endif  // DCHECK_IS_ON()
+
 }  // namespace
 
 class AudioRendererHost::AudioEntry
     : public media::AudioOutputController::EventHandler {
  public:
   AudioEntry(AudioRendererHost* host,
              int stream_id,
              int render_frame_id,
              const media::AudioParameters& params,
              const std::string& output_device_id,
@@ skipping 80 matching lines @@
                                      const std::string& salt)
     : BrowserMessageFilter(AudioMsgStart),
       render_process_id_(render_process_id),
       audio_manager_(audio_manager),
       mirroring_manager_(mirroring_manager),
       audio_log_(media_internals->CreateAudioLog(
           media::AudioLogFactory::AUDIO_OUTPUT_CONTROLLER)),
       media_stream_manager_(media_stream_manager),
       num_playing_streams_(0),
       salt_(salt),
+#if DCHECK_IS_ON()
+      validate_render_frame_id_function_(&ValidateRenderFrameId),
+#endif  // DCHECK_IS_ON()
       max_simultaneous_streams_(0) {
   DCHECK(audio_manager_);
   DCHECK(media_stream_manager_);
 }
 
 AudioRendererHost::~AudioRendererHost() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   CHECK(audio_entries_.empty());
 
   // If we had any streams, report UMA stats for the maximum number of
@@ skipping 308 matching lines @@
       stream_id, media::OUTPUT_DEVICE_STATUS_OK, output_params, std::string()));
 }
 
 void AudioRendererHost::OnCreateStream(int stream_id,
                                        int render_frame_id,
                                        const media::AudioParameters& params) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DVLOG(1) << "AudioRendererHost@" << this << "::OnCreateStream"
            << "(stream_id=" << stream_id << ")";
 
+  // Determine whether to use the device_unique_id from an authorization, or an
+  // empty string (i.e., when no previous authorization was requested, assume
+  // default device).
+  std::string device_unique_id;
   const auto& auth_data = authorizations_.find(stream_id);
-
-  // If no previous authorization requested, assume default device
-  if (auth_data == authorizations_.end()) {
-    DoCreateStream(stream_id, render_frame_id, params, std::string());
-    return;
+  if (auth_data != authorizations_.end()) {
+    CHECK(auth_data->second.first);
+    device_unique_id.swap(auth_data->second.second);
+    authorizations_.erase(auth_data);
   }
 
-  CHECK(auth_data->second.first);
-  DoCreateStream(stream_id, render_frame_id, params, auth_data->second.second);
-  authorizations_.erase(auth_data);
+#if DCHECK_IS_ON()
+  // When DCHECKs are turned on, hop over to the UI thread to validate the
+  // |render_frame_id|, then continue stream creation on the IO thread. See
+  // comment at top of DoCreateStream() for further details.
+  BrowserThread::PostTask(
+      BrowserThread::UI, FROM_HERE,
+      base::Bind(validate_render_frame_id_function_, render_process_id_,
+                 render_frame_id,
+                 base::Bind(&AudioRendererHost::DoCreateStream, this, stream_id,
+                            render_frame_id, params, device_unique_id)));
+#else
+  DoCreateStream(stream_id, render_frame_id, params, device_unique_id,
+                 render_frame_id > 0);
+#endif  // DCHECK_IS_ON()
 }
 
 void AudioRendererHost::DoCreateStream(int stream_id,
                                        int render_frame_id,
                                        const media::AudioParameters& params,
-                                       const std::string& device_unique_id) {
+                                       const std::string& device_unique_id,
+                                       bool render_frame_id_is_valid) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-  // media::AudioParameters is validated in the deserializer.
-  if (LookupById(stream_id) != NULL) {
+  // Fail early if either of two sanity-checks fail:
+  //   1. There should not yet exist an AudioEntry for the given |stream_id|
+  //      since the renderer may not create two streams with the same ID.
+  //   2. The render frame ID was either invalid or the render frame host it
+  //      references has shutdown before the request could be fulfilled (race
+  //      condition). Renderers must *always* specify a valid render frame ID
+  //      for each audio output they create, as several browser-level features
+  //      depend on this (e.g., OOM manager, UI audio indicator, muting, audio
+  //      capture).
+  // Note: media::AudioParameters is validated in the deserializer, so there is
+  // no need to check that here.
+  if (LookupById(stream_id)) {
     SendErrorMessage(stream_id);
     return;
   }
+  if (!render_frame_id_is_valid) {
+    SendErrorMessage(stream_id);
+    return;
+  }
 
   // Create the shared memory and share with the renderer process.
   uint32_t shared_memory_size = sizeof(media::AudioOutputBufferParameters) +
                                 AudioBus::CalculateMemorySize(params);
   std::unique_ptr<base::SharedMemory> shared_memory(new base::SharedMemory());
   if (!shared_memory->CreateAndMapAnonymous(shared_memory_size)) {
     SendErrorMessage(stream_id);
     return;
   }
 
@@ skipping 246 matching lines @@
   callback.Run(false, device_info);
 }
 
 bool AudioRendererHost::IsAuthorizationStarted(int stream_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   const auto& i = authorizations_.find(stream_id);
   return i != authorizations_.end();
 }
 
 }  // namespace content