Add back RenderFrameHost sanity-check to AudioRendererHost.

content/browser/renderer_host/media/audio_renderer_host.h

Index: content/browser/renderer_host/media/audio_renderer_host.h
diff --git a/content/browser/renderer_host/media/audio_renderer_host.h b/content/browser/renderer_host/media/audio_renderer_host.h
index 3e5374a24772b41c1b17c4477e630cd1d26caae7..9e0f4227a0b81e3f82ea3d329f653a9a0c806d05 100644
--- a/content/browser/renderer_host/media/audio_renderer_host.h
+++ b/content/browser/renderer_host/media/audio_renderer_host.h
@@ -49,6 +49,7 @@
 
 #include "base/atomic_ref_count.h"
 #include "base/gtest_prod_util.h"
+#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/process/process.h"
@@ -129,6 +130,14 @@ class CONTENT_EXPORT AudioRendererHost : public BrowserMessageFilter {
                               const AudioOutputDeviceInfo& device_info)>
       OutputDeviceInfoCB;
 
+  // The type of a function that is run on the UI thread to check whether the
+  // routing IDs reference a valid RenderFrameHost. The function then runs
+  // |callback| on the IO thread with true/false if valid/invalid.
+  using ValidateRenderFrameIdFunction =
+      void (*)(int render_process_id,
+               int render_frame_id,
+               const base::Callback<void(bool)>& callback);
+
   ~AudioRendererHost() override;
 
   // Methods called on IO thread ----------------------------------------------
@@ -188,7 +197,8 @@ class CONTENT_EXPORT AudioRendererHost : public BrowserMessageFilter {
   void DoCreateStream(int stream_id,
                       int render_frame_id,
                       const media::AudioParameters& params,
-                      const std::string& device_unique_id);
+                      const std::string& device_unique_id,
+                      bool render_frame_id_is_valid);
 
   // Complete the process of creating an audio stream. This will set up the
   // shared memory or shared socket in low latency mode and send the
@@ -239,6 +249,15 @@ class CONTENT_EXPORT AudioRendererHost : public BrowserMessageFilter {
   // |stream_id| has started.
   bool IsAuthorizationStarted(int stream_id);
 
+#if DCHECK_IS_ON()
+  // Called from AudioRendererHostTest to override the function that checks for
+  // the existence of the RenderFrameHost at stream creation time.
+  void set_render_frame_id_validate_function_for_testing(
+      ValidateRenderFrameIdFunction function) {
+    validate_render_frame_id_function_ = function;
+  }
+#endif  // DCHECK_IS_ON()
+
   // ID of the RenderProcessHost that owns this instance.
   const int render_process_id_;
 
@@ -265,6 +284,13 @@ class CONTENT_EXPORT AudioRendererHost : public BrowserMessageFilter {
   // The second element contains the unique ID of the authorized device.
   std::map<int, std::pair<bool, std::string>> authorizations_;
 
+#if DCHECK_IS_ON()
+  // When DCHECKs are turned on, AudioRendererHost will call this function on
+  // the UI thread to validate render frame IDs. A default is set by the
+  // constructor, but this can be overridden by unit tests.
+  ValidateRenderFrameIdFunction validate_render_frame_id_function_;
+#endif  // DCHECK_IS_ON()
+
   // The maximum number of simultaneous streams during the lifetime of this
   // host. Reported as UMA stat at shutdown.
   size_t max_simultaneous_streams_;