Disallow cross-thread Persistent<> read access.

third_party/WebKit/Source/modules/webaudio/MediaElementAudioSourceNode.h

 /*
  * Copyright (C) 2011, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 27 matching lines @@
 class BaseAudioContext;
 class HTMLMediaElement;
 class MediaElementAudioSourceOptions;
 
 class MediaElementAudioSourceHandler final : public AudioHandler {
  public:
   static PassRefPtr<MediaElementAudioSourceHandler> create(AudioNode&,
                                                            HTMLMediaElement&);
   ~MediaElementAudioSourceHandler() override;
 
-  HTMLMediaElement* mediaElement() { return m_mediaElement.get(); }
+  HTMLMediaElement* mediaElement() const;
 
   // AudioHandler
   void dispose() override;
   void process(size_t framesToProcess) override;
 
   // Helpers for AudioSourceProviderClient implementation of
   // MediaElementAudioSourceNode.
   void setFormat(size_t numberOfChannels, float sampleRate);
   void onCurrentSrcChanged(const KURL& currentSrc);
   void lock();
@@ skipping 10 matching lines @@
   // Must be called only on the main thread.
   bool passesCurrentSrcCORSAccessCheck(const KURL& currentSrc);
 
   // Print warning if CORS restrictions cause MediaElementAudioSource to output
   // zeroes.
   void printCORSMessage(const String& message);
 
   // This Persistent doesn't make a reference cycle. The reference from
   // HTMLMediaElement to AudioSourceProvideClient, which
   // MediaElementAudioSourceNode implements, is weak.
-  Persistent<HTMLMediaElement> m_mediaElement;
+  //
+  // It is accessed by both audio and main thread.
+  CrossThreadPersistent<HTMLMediaElement> m_mediaElement;

[haraken, 2017/02/20 23:57:18]

Ditto.

   Mutex m_processLock;
 
   unsigned m_sourceNumberOfChannels;
   double m_sourceSampleRate;
 
   std::unique_ptr<MultiChannelResampler> m_multiChannelResampler;
 
   // |m_passesCurrentSrcCORSAccessCheck| holds the value of
   // context()->getSecurityOrigin() &&
   // context()->getSecurityOrigin()->canRequest(mediaElement()->currentSrc()),
@@ skipping 36 matching lines @@
   void lock() override;
   void unlock() override;
 
  private:
   MediaElementAudioSourceNode(BaseAudioContext&, HTMLMediaElement&);
 };
 
 }  // namespace blink
 
 #endif  // MediaElementAudioSourceNode_h