Bug 876252 - Stop the AudioBufferSourceNode if the offset is no longer valid after setting a new buffer more effectively; r=roc

Calling Stop() here is not quite enough, because web content might call stop() again
with a non-zero argument, which overrides what we do here.

content/media/test/crashtests/876252.html

@@ -0,0 +1,23 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource4=Context0.createBufferSource();
+BufferSource4.start(0.05386466556228697,0.397192713804543,0.48810303467325866);
+
+BufferSource4.buffer=function(){
+	var length=109076;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(370))};
+	return Buffer;
+}();
+
+BufferSource4.buffer=function(){
+	var length=19339;
+	var Buffer=Context0.createBuffer(1,length,53362);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(-0.16235407581552863))};
+	return Buffer;
+}();
+
+BufferSource4.stop(0.46482366253621876);
+</script>

content/media/test/crashtests/crashtests.list

@@ -22,3 +22,4 @@ load 874952.html
 load 875144.html
 load 875596.html
 load 875911.html
+load 876252.html

content/media/webaudio/AudioBufferSourceNode.cpp

@@ -547,10 +547,12 @@ AudioBufferSourceNode::SendOffsetAndDurationParametersToStream(AudioNodeStream*
 
   if (offset >= endOffset) {
     // The offset falls past the end of the buffer.  In this case, we need to
-    // stop the playback immediately if it's in progress.  No need to check
-    // mStartCalled here, since Stop() does that for us.
-    ErrorResult rv;
-    Stop(0.0, rv);
+    // stop the playback immediately if it's in progress.
+    // Note that we can't call Stop() here since that might be overridden if
+    // web content calls Stop() too, so we just null out the buffer.
+    if (mStartCalled) {
+      aStream->SetBuffer(nullptr);
+    }
     return;
   }