Code:  double ConvolverNode::latencyTime() const
 {
    return m_reverb ? m_reverb->latencyFrames() / static_cast<double>(sampleRate()) : 0;
 }

Vulnerability Type: DoS 
CWE ID: CWE-362
Summary: Multiple race conditions in the Web Audio implementation in Blink, as used in Google Chrome before 30.0.1599.66, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to threading in core/html/HTMLMediaElement.cpp, core/platform/audio/AudioDSPKernelProcessor.cpp, core/platform/audio/HRTFElevation.cpp, and modules/webaudio/ConvolverNode.cpp.
Commit Message: Fix threading races on ConvolverNode::m_reverb in ConvolverNode::latencyFrames()

According to the crash report (https://cluster-fuzz.appspot.com/testcase?key=6515787040817152),
ConvolverNode::m_reverb races between ConvolverNode::latencyFrames() and ConvolverNode::setBuffer().
This CL adds a proper lock for ConvolverNode::m_reverb.

BUG=223962
No tests because the crash depends on threading races and thus not reproducible.

Review URL: https://chromiumcodereview.appspot.com/23514037

git-svn-id: svn://svn.chromium.org/blink/trunk@157245 bbb929c8-8fbe-4397-9dbb-9b2b20218538