Avoid unsafe heap access from audio thread.

third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h

 /*
  * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 435 matching lines @@
   // The main thread controls m_activeSourceNodes, all updates and additions
   // are performed by it. When the audio thread marks a source node as finished,
   // the nodes are added to |m_finishedSourceNodes| and scheduled for removal
   // from |m_activeSourceNodes| by the main thread.
   HashSet<UntracedMember<AudioNode>> finished_source_nodes_;
 
   // FIXME(dominicc): Move these to AudioContext because only
   // it creates these Promises.
   // Handle Promises for resume() and suspend()
   void ResolvePromisesForResume();
-  void ResolvePromisesForResumeOnMainThread();
+
+  void PerformCleanupOnMainThread();
+  void ScheduleMainThreadCleanup();
 
   // When the context is going away, reject any pending script promise
   // resolvers.
   virtual void RejectPendingResolvers();
 
   // Record the current autoplay status and clear it.
   void RecordAutoplayStatus();
 
   // True if we're in the process of resolving promises for resume().  Resolving
   // can take some time and the audio context process loop is very fast, so we
   // don't want to call resolve an excessive number of times.
   bool is_resolving_resume_promises_;
 
+  // Set to |true| by the audio thread when it posts a main-thread task to
+  // perform delayed state sync'ing updates that needs to be done on the main
+  // thread. Cleared by the main thread task once it has run.
+  bool has_posted_cleanup_task_;
+
   // Whether a user gesture is required to start this AudioContext.
   bool user_gesture_required_;
 
   unsigned connection_count_;
 
   // Graph locking.
   RefPtr<DeferredTaskHandler> deferred_task_handler_;
 
   // The state of the BaseAudioContext.
   AudioContextState context_state_;
@@ skipping 28 matching lines @@
   // It is somewhat arbitrary and could be increased if necessary.
   enum { kMaxNumberOfChannels = 32 };
 
   Optional<AutoplayStatus> autoplay_status_;
   AudioIOPosition output_position_;
 };
 
 }  // namespace blink
 
 #endif  // BaseAudioContext_h