Carefully handle large end time values in AudioParam automations

third_party/WebKit/Source/modules/webaudio/AudioParamTimeline.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 403 matching lines @@
         double deltaTime = time2 - time1;
         float k = deltaTime > 0 ? 1 / deltaTime : 0;
 
         // |fillToEndFrame| is the exclusive upper bound of the last frame to be computed for this
         // event.  It's either the last desired frame (|endFrame|) or derived from the end time of
         // the next event (time2). We compute ceil(time2*sampleRate) because fillToEndFrame is the
         // exclusive upper bound.  Consider the case where |startFrame| = 128 and time2 = 128.1
         // (assuming sampleRate = 1).  Since time2 is greater than 128, we want to output a value
         // for frame 128.  This requires that fillToEndFrame be at least 129.  This is achieved by
         // ceil(time2).
-        size_t fillToEndFrame = std::min(endFrame, static_cast<size_t>(ceil(time2 * sampleRate)));
+        //
+        // However, time2 can be very large, so compute this carefully in the case where time2
+        // exceeds the size of a size_t.
+
+        size_t fillToEndFrame = endFrame;
+        if (endFrame > time2 * sampleRate)
+            fillToEndFrame = static_cast<size_t>(ceil(time2 * sampleRate));
+
         ASSERT(fillToEndFrame >= startFrame);
         size_t fillToFrame = fillToEndFrame - startFrame;
         fillToFrame = std::min(fillToFrame, static_cast<size_t>(numberOfValues));
 
         ParamEvent::Type nextEventType = nextEvent ? static_cast<ParamEvent::Type>(nextEvent->type()) : ParamEvent::LastType /* unknown */;
 
         // First handle linear and exponential ramps which require looking ahead to the next event.
         if (nextEventType == ParamEvent::LinearRampToValue) {
             const float valueDelta = value2 - value1;
 #if CPU(X86) || CPU(X86_64)
@@ skipping 329 matching lines @@
     // to the end of the values buffer.
     for (; writeIndex < numberOfValues; ++writeIndex)
         values[writeIndex] = value;
 
     // This value is used to set the .value attribute of the AudioParam.
     return value;
 }
 
 } // namespace blink