Avoid unsafe heap access from audio thread.

third_party/WebKit/Source/platform/heap/ThreadState.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1422 matching lines @@
 void ThreadState::CollectGarbage(BlinkGC::StackState stack_state,
                                  BlinkGC::GCType gc_type,
                                  BlinkGC::GCReason reason) {
   // Nested collectGarbage() invocations aren't supported.
   CHECK(!IsGCForbidden());
   CompleteSweep();
 
   GCForbiddenScope gc_forbidden_scope(this);
 
   {
+    // No access to GCing arenas is allowed by other threads while
+    // a GC runs; grab a lock to indicate that GC is underway. Should
+    // any other thread need to access object on the heap, it will have
+    // to be while in a GCLockScope also.
+    GCLockScope gc_lock(this);
+
     // Access to the CrossThreadPersistentRegion has to be prevented while in
     // the marking phase because otherwise other threads may allocate or free
     // PersistentNodes and we can't handle that.
     CrossThreadPersistentRegion::LockScope persistent_lock(
         ProcessHeap::GetCrossThreadPersistentRegion());
     {
       SafePointScope safe_point_scope(stack_state, this);
 
       std::unique_ptr<Visitor> visitor;
       if (gc_type == BlinkGC::kTakeSnapshot) {
@@ skipping 103 matching lines @@
     CollectGarbage(BlinkGC::kNoHeapPointersOnStack, BlinkGC::kGCWithSweep,
                    BlinkGC::kForcedGC);
     size_t live_objects = Heap().HeapStats().MarkedObjectSize();
     if (live_objects == previous_live_objects)
       break;
     previous_live_objects = live_objects;
   }
 }
 
 }  // namespace blink