Fix premature access on m_fifo in AudioDestination.

third_party/WebKit/Source/platform/audio/AudioDestination.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 52 matching lines @@
                                    const WebAudioLatencyHint& latencyHint,
                                    PassRefPtr<SecurityOrigin> securityOrigin)
     : m_numberOfOutputChannels(numberOfOutputChannels),
       m_isPlaying(false),
       m_callback(callback),
       m_outputBus(AudioBus::create(numberOfOutputChannels,
                                    AudioUtilities::kRenderQuantumFrames,
                                    false)),
       m_renderBus(AudioBus::create(numberOfOutputChannels,
                                    AudioUtilities::kRenderQuantumFrames)),
+      m_fifo(
+          WTF::wrapUnique(new PushPullFIFO(numberOfOutputChannels, kFIFOSize))),
       m_framesElapsed(0) {
+  m_callbackBufferSize = hardwareBufferSize();
+  if (!checkBufferSize()) {
+    NOTREACHED();
+  }
+
   // Create WebAudioDevice. blink::WebAudioDevice is designed to support the
   // local input (e.g. loopback from OS audio system), but Chromium's media
   // renderer does not support it currently. Thus, we use zero for the number
   // of input channels.
   m_webAudioDevice = WTF::wrapUnique(Platform::current()->createAudioDevice(
       0, numberOfOutputChannels, latencyHint, this, String(),
       std::move(securityOrigin)));
   DCHECK(m_webAudioDevice);
-
-  m_callbackBufferSize = m_webAudioDevice->framesPerBuffer();
-
-  if (!checkBufferSize()) {
-    NOTREACHED();
-  }
-
-  // Create a FIFO.
-  m_fifo = WTF::wrapUnique(new PushPullFIFO(numberOfOutputChannels, kFIFOSize));
 }
 
 AudioDestination::~AudioDestination() {
   stop();
 }
 
 void AudioDestination::render(const WebVector<float*>& destinationData,
                               size_t numberOfFrames,
                               double delay,
                               double delayTimestamp,
                               size_t priorFramesSkipped) {
   CHECK_EQ(destinationData.size(), m_numberOfOutputChannels);
   CHECK_EQ(numberOfFrames, m_callbackBufferSize);
 
+  // Note that this method is called by AudioDeviceThread. If FIFO is not ready,
+  // or the requested render size is greater than FIFO size return here.
+  // (crbug.com/692423)
+  if (!m_fifo || m_fifo->length() < numberOfFrames)
+    return;
+
   m_framesElapsed -= std::min(m_framesElapsed, priorFramesSkipped);
   double outputPosition =
       m_framesElapsed / static_cast<double>(m_webAudioDevice->sampleRate()) -
       delay;
   m_outputPosition.position = outputPosition;
   m_outputPosition.timestamp = delayTimestamp;
   m_outputPositionReceivedTimestamp = base::TimeTicks::Now();
 
   // Associate the destination data array with the output bus then fill the
   // FIFO.
@@ skipping 79 matching lines @@
   callbackBufferSizeHistogram.sample(m_callbackBufferSize);
 
   // Check if the requested buffer size is too large.
   bool isBufferSizeValid =
       m_callbackBufferSize + AudioUtilities::kRenderQuantumFrames <= kFIFOSize;
   DCHECK(isBufferSizeValid);
   return isBufferSizeValid;
 }
 
 }  // namespace blink