Fix data race in WebRtcAudioRenderer.

content/renderer/media/webrtc_audio_renderer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/media/webrtc_audio_renderer.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 284 matching lines @@
 
   DCHECK_EQ(state_, PLAYING);
   DCHECK_GT(play_ref_count_, 0);
   if (!--play_ref_count_)
     state_ = PAUSED;
 }
 
 void WebRtcAudioRenderer::Stop() {
   DVLOG(1) << "WebRtcAudioRenderer::Stop()";
   DCHECK(thread_checker_.CalledOnValidThread());
-  // If |max_render_time_| is zero, no render call has been made.
-  if (!max_render_time_.is_zero()) {
-    UMA_HISTOGRAM_CUSTOM_COUNTS(
-        "Media.Audio.Render.GetSourceDataTimeMax.WebRTC",
-        max_render_time_.InMicroseconds(), kRenderTimeHistogramMinMicroseconds,
-        kRenderTimeHistogramMaxMicroseconds, 50);
-    max_render_time_ = base::TimeDelta();
-  }
-
   {
     base::AutoLock auto_lock(lock_);
     if (state_ == UNINITIALIZED)
       return;
 
     if (--start_ref_count_)
       return;
 
     DVLOG(1) << "Calling RemoveAudioRenderer and Stop().";
 
     source_->RemoveAudioRenderer(this);
     source_ = NULL;
     state_ = UNINITIALIZED;
   }
 
+  // Apart from here, |max_render_time_| is only accessed in SourceCallback(),
+  // which is guaranteed to not run after |source_| has been set to null, and
+  // not before this function has returned.
+  // If |max_render_time_| is zero, no render call has been made.
+  if (!max_render_time_.is_zero()) {
+    UMA_HISTOGRAM_CUSTOM_COUNTS(
+        "Media.Audio.Render.GetSourceDataTimeMax.WebRTC",
+        max_render_time_.InMicroseconds(),
+        kRenderTimeHistogramMinMicroseconds,
+        kRenderTimeHistogramMaxMicroseconds, 50);
+    max_render_time_ = base::TimeDelta();
+  }
+
   // Make sure to stop the sink while _not_ holding the lock since the Render()
   // callback may currently be executing and trying to grab the lock while we're
   // stopping the thread on which it runs.
   sink_->Stop();
 }
 
 void WebRtcAudioRenderer::SetVolume(float volume) {
   DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK(volume >= 0.0f && volume <= 1.0f);
 
@@ skipping 322 matching lines @@
           base::Bind(&WebRtcAudioRenderer::SourceCallback,
                      base::Unretained(this))));
     }
     sink_params_ = new_sink_params;
   }
 
   sink_->Initialize(new_sink_params, this);
 }
 
 }  // namespace content