Code:  float AudioParam::finalValue()
 {
    float value;
     calculateFinalValues(&value, 1, false);
     return value;
 }

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: modules/webaudio/BiquadDSPKernel.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 37.0.2062.94, does not properly consider concurrent threads during attempts to update biquad filter coefficients, which allows remote attackers to cause a denial of service (read of uninitialized memory) via crafted API calls.
Commit Message: Initialize value since calculateFinalValues may fail to do so.

Fix threading issue where updateCoefficientsIfNecessary was not always
called from the audio thread. This causes the value not to be
initialized.

Thus,

o Initialize the variable to some value, just in case.
o Split updateCoefficientsIfNecessary into two functions with the code
  that sets the coefficients pulled out in to the new function
  updateCoefficients.
o Simplify updateCoefficientsIfNecessary since useSmoothing was always
  true, and forceUpdate is not longer needed.
o Add process lock to prevent the audio thread from updating the
  coefficients while they are being read in the main thread. The audio
  thread will update them the next time around.
o Make getFrequencyResponse set the lock while reading the
  coefficients of the biquad in preparation for computing the
  frequency response.

BUG=389219

Review URL: https://codereview.chromium.org/354213002

git-svn-id: svn://svn.chromium.org/blink/trunk@177250 bbb929c8-8fbe-4397-9dbb-9b2b20218538