Bug 874915 - Stop the AudioBufferSourceNode if the offset is no longer valid after setting a new buffer; r=roc

--HG--
extra : rebase_source : 0b179aab5ddb1ffd4ab2aeb8366b36975c949187

content/media/test/crashtests/874915.html

@@ -0,0 +1,24 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource6=Context0.createBufferSource();
+
+setInterval(function(){
+BufferSource6.buffer=function(){
+	var length=11283;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(624))};
+	return Buffer;
+}();
+},0)
+
+BufferSource6.start(0.15831333969254047,0.23571860056836158,0.529235512483865);
+
+BufferSource6.buffer=function(){
+	var length=48517;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(365))};
+	return Buffer;
+}();
+</script>

content/media/test/crashtests/874934.html

@@ -0,0 +1,23 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource0=Context0.createBufferSource();
+BufferSource0.start(0.01932738965842873,0.33345631847623736,0.3893404237460345);
+BufferSource0.buffer=function(){
+	var length=35887;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(0.39765272522345185))};
+	return Buffer;
+}();
+
+BufferSource0.buffer=function(){
+	var length=15952;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(85))};
+	return Buffer;
+}();
+
+BufferSource0.playbackRate.value=20.401213286832185;
+
+</script>

content/media/test/crashtests/crashtests.list

@@ -16,3 +16,5 @@ load 844563.html
 load 846612.html
 load 852838.html
 load 874869.html
+load 874915.html
+load 874934.html

content/media/webaudio/AudioBufferSourceNode.cpp

@@ -541,6 +541,11 @@ AudioBufferSourceNode::SendOffsetAndDurationParametersToStream(AudioNodeStream*
                      length : std::min(aOffset + aDuration, length);
 
   if (offset >= endOffset) {
+    // The offset falls past the end of the buffer.  In this case, we need to
+    // stop the playback immediately if it's in progress.  No need to check
+    // mStartCalled here, since Stop() does that for us.
+    ErrorResult rv;
+    Stop(0.0, rv);
     return;
   }