From 1332efbf7b1811aa07b2454529afaf89ced8e29a Mon Sep 17 00:00:00 2001
From: Guido Urdaneta <guidou@chromium.org>
Date: Mon, 25 May 2026 09:14:59 -0700
Subject: [PATCH] [Audio] Fix race in AudioOutputAuthorizationHandler

Ensure access to the `hashed_device_id_for_global_media_controls_` field
always occurs on the IO thread.

Fixed: 497632232
Change-Id: I7720576858dc857299a5e603da4ab267587a3f9c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7865624
Reviewed-by: Olga Sharonova <olka@chromium.org>
Commit-Queue: Guido Urdaneta <guidou@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1635745}
---

diff --git a/content/browser/renderer_host/media/audio_output_authorization_handler.cc b/content/browser/renderer_host/media/audio_output_authorization_handler.cc
index a0ffc17..7b675488 100644
--- a/content/browser/renderer_host/media/audio_output_authorization_handler.cc
+++ b/content/browser/renderer_host/media/audio_output_authorization_handler.cc
@@ -229,6 +229,7 @@
 
 void AudioOutputAuthorizationHandler::
     SetAuthorizedDeviceIdForGlobalMediaControls(std::string hashed_device_id) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
   hashed_device_id_for_global_media_controls_ = std::move(hashed_device_id);
 }
 
diff --git a/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc b/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc
index ab46009f..ec5a5f40 100644
--- a/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc
+++ b/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc
@@ -215,8 +215,17 @@
 
 void RenderFrameAudioOutputStreamFactory::
     SetAuthorizedDeviceIdForGlobalMediaControls(std::string hashed_device_id) {
-  core_->SetAuthorizedDeviceIdForGlobalMediaControls(
-      std::move(hashed_device_id));
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  // base::Unretained(core_.get()) is safe here because |core_| is owned by
+  // RenderFrameAudioOutputStreamFactory and the
+  // RenderFrameAudioOutputStreamFactory destructor posts a task to delete
+  // |core_| on the IO thread. Since both tasks are posted to IO thread, the
+  // task posted here will always execute before the destruction task.
+  GetIOThreadTaskRunner({})->PostTask(
+      FROM_HERE,
+      base::BindOnce(&Core::SetAuthorizedDeviceIdForGlobalMediaControls,
+                     base::Unretained(core_.get()),
+                     std::move(hashed_device_id)));
 }
 
 size_t
@@ -265,6 +274,7 @@
 
 void RenderFrameAudioOutputStreamFactory::Core::
     SetAuthorizedDeviceIdForGlobalMediaControls(std::string hashed_device_id) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
   authorization_handler_.SetAuthorizedDeviceIdForGlobalMediaControls(
       std::move(hashed_device_id));
 }