Fix premature access on m_fifo in AudioDestination.

third_party/WebKit/Source/platform/audio/AudioDestination.cpp

Index: third_party/WebKit/Source/platform/audio/AudioDestination.cpp
diff --git a/third_party/WebKit/Source/platform/audio/AudioDestination.cpp b/third_party/WebKit/Source/platform/audio/AudioDestination.cpp
index 81e007261640b149d504feb6e3cea39804c10d15..691ffb179e83c9f520c1d35e7ec0999ce6aac965 100644
--- a/third_party/WebKit/Source/platform/audio/AudioDestination.cpp
+++ b/third_party/WebKit/Source/platform/audio/AudioDestination.cpp
@@ -70,7 +70,14 @@ AudioDestination::AudioDestination(AudioIOCallback& callback,
                                    false)),
       m_renderBus(AudioBus::create(numberOfOutputChannels,
                                    AudioUtilities::kRenderQuantumFrames)),
+      m_fifo(
+          WTF::wrapUnique(new PushPullFIFO(numberOfOutputChannels, kFIFOSize))),
       m_framesElapsed(0) {
+  m_callbackBufferSize = hardwareBufferSize();
+  if (!checkBufferSize()) {
+    NOTREACHED();
+  }
+
   // Create WebAudioDevice. blink::WebAudioDevice is designed to support the
   // local input (e.g. loopback from OS audio system), but Chromium's media
   // renderer does not support it currently. Thus, we use zero for the number
@@ -79,15 +86,6 @@ AudioDestination::AudioDestination(AudioIOCallback& callback,
       0, numberOfOutputChannels, latencyHint, this, String(),
       std::move(securityOrigin)));
   DCHECK(m_webAudioDevice);
-
-  m_callbackBufferSize = m_webAudioDevice->framesPerBuffer();
-
-  if (!checkBufferSize()) {
-    NOTREACHED();
-  }
-
-  // Create a FIFO.
-  m_fifo = WTF::wrapUnique(new PushPullFIFO(numberOfOutputChannels, kFIFOSize));
 }
 
 AudioDestination::~AudioDestination() {
@@ -102,6 +100,12 @@ void AudioDestination::render(const WebVector<float*>& destinationData,
   CHECK_EQ(destinationData.size(), m_numberOfOutputChannels);
   CHECK_EQ(numberOfFrames, m_callbackBufferSize);
 
+  // Note that this method is called by AudioDeviceThread. If FIFO is not ready,
+  // or the requested render size is greater than FIFO size return here.
+  // (crbug.com/692423)
+  if (!m_fifo || m_fifo->length() < numberOfFrames)
+    return;
+
   m_framesElapsed -= std::min(m_framesElapsed, priorFramesSkipped);
   double outputPosition =
       m_framesElapsed / static_cast<double>(m_webAudioDevice->sampleRate()) -