Avoid unsafe heap access from audio thread.

third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h

Index: third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h
diff --git a/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h b/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h
index 13db3f7c07f6e5eb2acee3eac9a31154841c9a8f..ade6805618b812187eb1b232753ddf33bbed195f 100644
--- a/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h
+++ b/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h
@@ -273,16 +273,6 @@ class MODULES_EXPORT BaseAudioContext
   // Called at the end of each render quantum.
   void HandlePostRenderTasks();
 
-  // Called periodically at the end of each render quantum to release
-  // finished source nodes.  Updates m_finishedSourceNodes with nodes
-  // to be deleted.  Returns true if any node needs deletion.  Must be
-  // run from the audio thread.
-  bool ReleaseFinishedSourceNodes();
-
-  // The finished source nodes found by |releaseFinishedSourceNodes|
-  // will be removed on the main thread, which is done here.
-  void RemoveFinishedSourceNodes(bool needs_removal);
-
   // Keeps track of the number of connections made.
   void IncrementConnectionCount() {
     DCHECK(IsMainThread());
@@ -413,11 +403,6 @@ class MODULES_EXPORT BaseAudioContext
   // haven't finished playing.  Make sure to release them here.
   void ReleaseActiveSourceNodes();
 
-  // Actually remove the nodes noted for deletion by
-  // releaseFinishedSourceNodes.  Must be run from the main thread,
-  // and must not be run with the context lock.
-  void RemoveFinishedSourceNodesOnMainThread();
-
   // Returns the Document wich wich the instance is associated.
   Document* GetDocument() const;
 
@@ -430,9 +415,12 @@ class MODULES_EXPORT BaseAudioContext
   // Listener for the PannerNodes
   Member<AudioListener> listener_;
 
-  // Only accessed in the audio thread.
+  // Accessed by audio thread and main thread, coordinated using
+  // the associated mutex.
+  //
   // These raw pointers are safe because AudioSourceNodes in
-  // m_activeSourceNodes own them.
+  // active_source_nodes_ own them.
+  Mutex finished_source_handlers_mutex_;
   Vector<AudioHandler*> finished_source_handlers_;
 
   // List of source nodes. This is either accessed when the graph lock is
@@ -443,17 +431,13 @@ class MODULES_EXPORT BaseAudioContext
   // this.
   HeapVector<Member<AudioNode>> active_source_nodes_;
 
-  // The main thread controls m_activeSourceNodes, all updates and additions
-  // are performed by it. When the audio thread marks a source node as finished,
-  // the nodes are added to |m_finishedSourceNodes| and scheduled for removal
-  // from |m_activeSourceNodes| by the main thread.
-  HashSet<UntracedMember<AudioNode>> finished_source_nodes_;
-
   // FIXME(dominicc): Move these to AudioContext because only
   // it creates these Promises.
   // Handle Promises for resume() and suspend()
   void ResolvePromisesForResume();
-  void ResolvePromisesForResumeOnMainThread();
+
+  void PerformCleanupOnMainThread();
+  void ScheduleMainThreadCleanup();
 
   // When the context is going away, reject any pending script promise
   // resolvers.
@@ -467,6 +451,11 @@ class MODULES_EXPORT BaseAudioContext
   // don't want to call resolve an excessive number of times.
   bool is_resolving_resume_promises_;
 
+  // Set to |true| by the audio thread when it posts a main-thread task to
+  // perform delayed state sync'ing updates that needs to be done on the main
+  // thread. Cleared by the main thread task once it has run.
+  bool has_posted_cleanup_task_;
+
   // Whether a user gesture is required to start this AudioContext.
   bool user_gesture_required_;