Add a graph lock in PannerHandler::SetPanningModel()

We need the graph lock to secure the panner backend because
BaseAudioContext::Handle{Pre,Post}RenderTasks() from the audio thread
can touch it.

Test: ran two repro cases from the report over 1 hour and TSAN survived.
Bug: 1042254
Change-Id: Ic394311e72fed51f9df1a961aba0f84b79aed8f1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2003564
Commit-Queue: Hongchan Choi <hongchan@chromium.org>
Reviewed-by: Raymond Toy <rtoy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#732610}

third_party/blink/renderer/modules/webaudio/panner_node.cc

@@ -390,6 +390,11 @@ bool PannerHandler::SetPanningModel(unsigned model) {
   }
 
   if (!panner_.get() || model != panning_model_) {
+    // We need the graph lock to secure the panner backend because
+    // BaseAudioContext::Handle{Pre,Post}RenderTasks() from the audio thread
+    // can touch it.
+    BaseAudioContext::GraphAutoLocker context_locker(Context());
+
     // This synchronizes with process().
     MutexLocker process_locker(process_lock_);
     panner_ = Panner::Create(model, Context()->sampleRate(),