Fix race condition in audio output controller and audio sync reader.

Reader can be called after controller stopped, causing hang and/or crash.
Fix consits of 2 parts:
(1) In low latency mode output controller should check its state, exactly like
in the high latency mode, and do not call reader if it is not playing anymore.
(2) Reader should not touch socket after it is closed, and socket-related
operations should be under the lock to avoid race with Close().

BUG=chromium-os:21130
BUG=chromium-os:17357

Review URL: http://codereview.chromium.org/8347004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@106326 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 8 insertions, 0 deletions

diff --git a/media/audio/audio_output_controller.cc b/media/audio/audio_output_controller.cc
index 3331701..7118eaa 100644
--- a/media/audio/audio_output_controller.cc
+++ b/media/audio/audio_output_controller.cc
@@ -323,6 +323,14 @@ uint32 AudioOutputController::OnMoreData(
   }
 
   // Low latency mode.
+  {
+    // Check state and do nothing if we are not playing.
+    // We are on the hardware audio thread, so lock is needed.
+    base::AutoLock auto_lock(lock_);
+    if (state_ != kPlaying) {
+      return 0;
+    }
+  }
   uint32 size =  sync_reader_->Read(dest, max_size);
   sync_reader_->UpdatePendingBytes(buffers_state.total_bytes() + size);
   return size;