miu@: assigning to you, since I'm not sure what is a better way to fix it rather than drop the check entirely (blocking IO thread on UI one does not look right). Probably we can just post ValidateRenderFrameId() to UI thread, proceed with DoCreateStream() and crash in UI thread later? 

miu@ ping: could you comment on this?

The render process is supposed to wait until it receives the AudioMsg_NotifyStreamCreated message before assuming any other operations will succeed.

However, it does seem silly to require additional IPC round-trips, which would only add to start-up latency. Thus, instead of fix the issue in the renderer code, I'll whip-up a CL to do the render frame validation in the browser process without delaying stream creation.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2dcff8d1a58297367bc577f4f3554bfffd2c9bd1

commit 2dcff8d1a58297367bc577f4f3554bfffd2c9bd1
Author: miu <miu@chromium.org>
Date: Fri Sep 09 18:33:03 2016

Fix race in AudioRendererHost around render frame ID validation.

A bug was identified where IPC messages controlling audio stream state
were being ignored/dropped: This was due to the fact that, in builds
where DCHECKs were turned on, the additional render frame ID validation
was delaying stream creation to a point after the control IPC messages
were being processed.

This change allows stream creation to proceed, with the render frame ID
validation happening in the background. If the validation fails, it will
error-out and force-close the stream later. The benefit of this change
is that it can also harmlessly be turned on for all builds (i.e., not
just when DCHECKs are turned on), for a more-robust security check on
the AudioHostMsg_CreateStream IPC message.

BUG= 633936 

Review-Url: https://codereview.chromium.org/2301353007
Cr-Commit-Position: refs/heads/master@{#417642}

[modify] https://crrev.com/2dcff8d1a58297367bc577f4f3554bfffd2c9bd1/content/browser/renderer_host/media/audio_renderer_host.cc
[modify] https://crrev.com/2dcff8d1a58297367bc577f4f3554bfffd2c9bd1/content/browser/renderer_host/media/audio_renderer_host.h
[modify] https://crrev.com/2dcff8d1a58297367bc577f4f3554bfffd2c9bd1/content/browser/renderer_host/media/audio_renderer_host_unittest.cc