Version: M53 (and later)
OS: all
What steps will reproduce the problem?(1) Renderer sends AudioHostMsg_RequestDeviceAuthorization with a non-default device ID.
(2) Before authorization is completed, renderer sends AudioHostMsg_CreateStream for the stream.
This doesn't happen during normal operation, only with buggy/compromised renderer
What is the expected output?
Either renderer kill by bad_message::ReceivedBadMessage or error reported to renderer.
What do you see instead?
Browser crash, because of the CHECK at https://cs.chromium.org/chromium/src/content/browser/renderer_host/media/audio_renderer_host.cc?sq=package:chromium&rcl=1475536681&l=498.
Comment 1 by maxmorin@chromium.org
, Oct 4 2016