Fix premature access on m_fifo in AudioDestination.

In the AudioDestination construction process, WebAudioDevice can start
the thread even before m_fifo is ready. This may result a crash when
render() method is called by AudioDeviceThread.

This CL implements a speculative fix of the incorrect order of
initialization.

BUG=692423
TEST=(none)

Review-Url: https://codereview.chromium.org/2740103005
Cr-Commit-Position: refs/heads/master@{#456204}

third_party/WebKit/Source/platform/audio/AudioDestination.cpp

@@ -70,7 +70,14 @@ AudioDestination::AudioDestination(AudioIOCallback& callback,
                                    false)),
       m_renderBus(AudioBus::create(numberOfOutputChannels,
                                    AudioUtilities::kRenderQuantumFrames)),
+      m_fifo(
+          WTF::wrapUnique(new PushPullFIFO(numberOfOutputChannels, kFIFOSize))),
       m_framesElapsed(0) {
+  m_callbackBufferSize = hardwareBufferSize();
+  if (!checkBufferSize()) {
+    NOTREACHED();
+  }
+
   // Create WebAudioDevice. blink::WebAudioDevice is designed to support the
   // local input (e.g. loopback from OS audio system), but Chromium's media
   // renderer does not support it currently. Thus, we use zero for the number
@@ -79,15 +86,6 @@ AudioDestination::AudioDestination(AudioIOCallback& callback,
       0, numberOfOutputChannels, latencyHint, this, String(),
       std::move(securityOrigin)));
   DCHECK(m_webAudioDevice);
-
-  m_callbackBufferSize = m_webAudioDevice->framesPerBuffer();
-
-  if (!checkBufferSize()) {
-    NOTREACHED();
-  }
-
-  // Create a FIFO.
-  m_fifo = WTF::wrapUnique(new PushPullFIFO(numberOfOutputChannels, kFIFOSize));
 }
 
 AudioDestination::~AudioDestination() {
@@ -102,6 +100,12 @@ void AudioDestination::render(const WebVector<float*>& destinationData,
   CHECK_EQ(destinationData.size(), m_numberOfOutputChannels);
   CHECK_EQ(numberOfFrames, m_callbackBufferSize);
 
+  // Note that this method is called by AudioDeviceThread. If FIFO is not ready,
+  // or the requested render size is greater than FIFO size return here.
+  // (crbug.com/692423)
+  if (!m_fifo || m_fifo->length() < numberOfFrames)
+    return;
+
   m_framesElapsed -= std::min(m_framesElapsed, priorFramesSkipped);
   double outputPosition =
       m_framesElapsed / static_cast<double>(m_webAudioDevice->sampleRate()) -