From 9baff6c056041ab1fc48ab437e1c9fe1832fa436 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Mon, 27 May 2013 20:17:24 -0400
Subject: [PATCH] Bug 876252 - Stop the AudioBufferSourceNode if the offset is
 no longer valid after setting a new buffer more effectively; r=roc

Calling Stop() here is not quite enough, because web content might call stop() again
with a non-zero argument, which overrides what we do here.
---
 content/media/test/crashtests/876252.html     | 23 +++++++++++++++++++
 content/media/test/crashtests/crashtests.list |  1 +
 .../media/webaudio/AudioBufferSourceNode.cpp  | 10 ++++----
 3 files changed, 30 insertions(+), 4 deletions(-)
 create mode 100644 content/media/test/crashtests/876252.html

diff --git a/content/media/test/crashtests/876252.html b/content/media/test/crashtests/876252.html
new file mode 100644
index 000000000000..cb9cb63ed3c8
--- /dev/null
+++ b/content/media/test/crashtests/876252.html
@@ -0,0 +1,23 @@
+<script>
+var Context0= new AudioContext()
+var BufferSource4=Context0.createBufferSource();
+BufferSource4.start(0.05386466556228697,0.397192713804543,0.48810303467325866);
+
+BufferSource4.buffer=function(){
+	var length=109076;
+	var Buffer=Context0.createBuffer(1,length,Context0.sampleRate);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(370))};
+	return Buffer;
+}();
+
+BufferSource4.buffer=function(){
+	var length=19339;
+	var Buffer=Context0.createBuffer(1,length,53362);
+	var bufferData= Buffer.getChannelData(0);
+	for (var i = 0; i < length; ++i) { bufferData[i] = Math.sin(i*(-0.16235407581552863))};
+	return Buffer;
+}();
+
+BufferSource4.stop(0.46482366253621876);
+</script>
diff --git a/content/media/test/crashtests/crashtests.list b/content/media/test/crashtests/crashtests.list
index aa2890694b8d..dec0d06dc8bd 100644
--- a/content/media/test/crashtests/crashtests.list
+++ b/content/media/test/crashtests/crashtests.list
@@ -22,3 +22,4 @@ load 874952.html
 load 875144.html
 load 875596.html
 load 875911.html
+load 876252.html
diff --git a/content/media/webaudio/AudioBufferSourceNode.cpp b/content/media/webaudio/AudioBufferSourceNode.cpp
index 663a9467868c..d5d680d9d04e 100644
--- a/content/media/webaudio/AudioBufferSourceNode.cpp
+++ b/content/media/webaudio/AudioBufferSourceNode.cpp
@@ -547,10 +547,12 @@ AudioBufferSourceNode::SendOffsetAndDurationParametersToStream(AudioNodeStream*
 
   if (offset >= endOffset) {
     // The offset falls past the end of the buffer.  In this case, we need to
-    // stop the playback immediately if it's in progress.  No need to check
-    // mStartCalled here, since Stop() does that for us.
-    ErrorResult rv;
-    Stop(0.0, rv);
+    // stop the playback immediately if it's in progress.
+    // Note that we can't call Stop() here since that might be overridden if
+    // web content calls Stop() too, so we just null out the buffer.
+    if (mStartCalled) {
+      aStream->SetBuffer(nullptr);
+    }
     return;
   }