Bug 878328 - Sanitize the time argument of AudioParam.setValueCurveAtTime; r=roc

content/media/test/crashtests/878328.html

@@ -0,0 +1,5 @@
+<script>
+o1 = new window.AudioContext(2, 7, 44100);
+o5 = o1.createDelay(1);
+o5.delayTime.setValueCurveAtTime(new Float32Array(3), 1.7976931348623157e+308, 0.64);
+</script>

content/media/test/crashtests/crashtests.list

@@ -33,4 +33,5 @@ load 876252.html
 load 876834.html
 load 877820.html
 load 878014.html
+load 878328.html
 load 878407.html

content/media/webaudio/AudioParam.h

@@ -53,6 +53,10 @@ public:
   // object.
   void SetValueCurveAtTime(const Float32Array& aValues, double aStartTime, double aDuration, ErrorResult& aRv)
   {
+    if (!WebAudioUtils::IsTimeValid(aStartTime)) {
+      aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+      return;
+    }
     AudioParamTimeline::SetValueCurveAtTime(aValues.Data(), aValues.Length(),
                                             aStartTime, aDuration, aRv);
     mCallback(mNode);