Fix premature access on m_fifo in AudioDestination.

third_party/WebKit/Source/platform/audio/PushPullFIFO.cpp

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "platform/audio/PushPullFIFO.h"
 
 #include <memory>
 #include "platform/audio/AudioUtilities.h"
 #include "wtf/PtrUtil.h"
 
@@ skipping 65 matching lines @@
 
   // Update the number of frames available in FIFO.
   m_framesAvailable =
       std::min(m_framesAvailable + inputBusLength, m_fifoLength);
   DCHECK_EQ((m_indexRead + m_framesAvailable) % m_fifoLength, m_indexWrite);
 }
 
 // Pull the data out of FIFO to |outputBus|. If remaining frame in the FIFO
 // is less than the frames to pull, provides remaining frame plus the silence.
 void PushPullFIFO::pull(AudioBus* outputBus, size_t framesRequested) {
-#if OS(ANDROID)
-  if (!outputBus) {
-    // Log when outputBus or FIFO object is invalid. (crbug.com/692423)
-    LOG(WARNING) << "[WebAudio/PushPullFIFO::pull <" << static_cast<void*>(this)
-                 << ">] |outputBus| is invalid.";
-    // Silently return to avoid crash.
-    return;
-  }
-
-  // The following checks are in place to catch the inexplicable crash.
-  // (crbug.com/692423)
-  if (framesRequested > outputBus->length()) {
-    LOG(WARNING) << "[WebAudio/PushPullFIFO::pull <" << static_cast<void*>(this)
-                 << ">] framesRequested > outputBus->length() ("
-                 << framesRequested << " > " << outputBus->length() << ")";
-  }
-  if (framesRequested > m_fifoLength) {
-    LOG(WARNING) << "[WebAudio/PushPullFIFO::pull <" << static_cast<void*>(this)
-                 << ">] framesRequested > m_fifoLength (" << framesRequested
-                 << " > " << m_fifoLength << ")";
-  }
-  if (m_indexRead >= m_fifoLength) {
-    LOG(WARNING) << "[WebAudio/PushPullFIFO::pull <" << static_cast<void*>(this)
-                 << ">] m_indexRead >= m_fifoLength (" << m_indexRead
-                 << " >= " << m_fifoLength << ")";
-  }
-#endif

[Raymond Toy, 2017/03/10 21:11:09]

Why get rid of all of these prints? They might not show up in the crash reports
but they seem useful if we could ever see the problem locally.

[hongchan, 2017/03/10 21:13:55]

Hmm. I thought we agreed upon deleting these for the fix. I will put them back
after M58 branching.

   CHECK(outputBus);
   SECURITY_CHECK(framesRequested <= outputBus->length());
   SECURITY_CHECK(framesRequested <= m_fifoLength);
   SECURITY_CHECK(m_indexRead < m_fifoLength);
 
   const size_t remainder = m_fifoLength - m_indexRead;
   const size_t framesToFill = std::min(m_framesAvailable, framesRequested);
 
   for (unsigned i = 0; i < m_fifoBus->numberOfChannels(); ++i) {
     const float* fifoBusChannel = m_fifoBus->channel(i)->data();
@@ skipping 40 matching lines @@
   m_framesAvailable -= framesToFill;
   DCHECK_EQ((m_indexRead + m_framesAvailable) % m_fifoLength, m_indexWrite);
 }
 
 const PushPullFIFOStateForTest PushPullFIFO::getStateForTest() const {
   return {length(),     numberOfChannels(), framesAvailable(), m_indexRead,
           m_indexWrite, m_overflowCount,    m_underflowCount};
 }
 
 }  // namespace blink