The cause is very likely that the WaveGenerator *lpWaveGen returned by lpToneGen->mWaveGens.valueFor(lFrequency) just before calling lpWaveGen->getSamples(lpOut, lGenSmp, lWaveCmd) is invalid. The frequency lFrequency is not part of the frequencies in mWaveGens.
This can happen if a different tone is started while the callback function is active: The state is changed to TONE_RESTARTING and the call to prepareWave() at line 1226 will change the tone descriptor pointed to by mpToneDesc as well as the content of mWaveGens. However, mpToneDesc was cached in a local variable lpToneDesc when entering the callback and is not reloaded when exiting prepareWave(). This causes a mismatch between the tone frequencies listed in lpToneDesc and the frequencies present in mWaveGens.
This regression was introduced in change 973 when mpToneDesc was cached in a local variable.
5964e73774