Remove dangerous CHECK. Add unit test.

content/browser/renderer_host/media/audio_renderer_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/media/audio_renderer_host.h"
 
 #include <stdint.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 477 matching lines @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DVLOG(1) << "AudioRendererHost@" << this << "::OnCreateStream"
            << "(stream_id=" << stream_id << ")";
 
   // Determine whether to use the device_unique_id from an authorization, or an
   // empty string (i.e., when no previous authorization was requested, assume
   // default device).
   std::string device_unique_id;
   const auto& auth_data = authorizations_.find(stream_id);
   if (auth_data != authorizations_.end()) {
-    CHECK(auth_data->second.first);
+    if (!auth_data->second.first) {
+      // The authorization for this stream is still pending, so it's an error
+      // to create it now.
+      content::bad_message::ReceivedBadMessage(
+          this, bad_message::ARH_CREATED_STREAM_WITHOUT_AUTHORIZATION);
+      return;
+    }
     device_unique_id.swap(auth_data->second.second);
     authorizations_.erase(auth_data);
   }
 
   // Fail early if either of two sanity-checks fail:
   //   1. There should not yet exist an AudioEntry for the given |stream_id|
   //      since the renderer may not create two streams with the same ID.
   //   2. An out-of-range render frame ID was provided. Renderers must *always*
   //      specify a valid render frame ID for each audio output they create, as
   //      several browser-level features depend on this (e.g., OOM manager, UI
@@ skipping 341 matching lines @@
       std::string() /* matched_device_id */));
 }
 
 bool AudioRendererHost::IsAuthorizationStarted(int stream_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   const auto& i = authorizations_.find(stream_id);
   return i != authorizations_.end();
 }
 
 }  // namespace content