Throw exception for non-finite values in setValueCurve

third_party/WebKit/Source/modules/webaudio/AudioParam.cpp

Index: third_party/WebKit/Source/modules/webaudio/AudioParam.cpp
diff --git a/third_party/WebKit/Source/modules/webaudio/AudioParam.cpp b/third_party/WebKit/Source/modules/webaudio/AudioParam.cpp
index 309aa186cf6793732b6f4b2a0226bc6602be56b1..79f4680b8d3808db79b774c9b68d24ee9166f15c 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioParam.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioParam.cpp
@@ -25,6 +25,7 @@
 
 #include "modules/webaudio/AudioParam.h"
 
+#include "core/dom/ExceptionCode.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "modules/webaudio/AudioNode.h"
 #include "modules/webaudio/AudioNodeOutput.h"
@@ -461,8 +462,20 @@ AudioParam* AudioParam::setValueCurveAtTime(DOMFloat32Array* curve, double time,
     float max = maxValue();
 
     for (unsigned k = 0; k < curve->length(); ++k) {
-        if (curveData[k] < min || curveData[k] > max) {
-            warnIfOutsideRange("setValueCurveAtTime value", curveData[k]);
+        float value = curveData[k];
+
+        if (!std::isfinite(value)) {
+            exceptionState.throwDOMException(
+                V8TypeError,
+                "The provided float value for the curve at element "
+                + String::number(k)
+                + " is non-finite: "
+                + String::number(value));
+            return nullptr;
+        }
+
+        if (value < min || value > max) {
+            warnIfOutsideRange("setValueCurveAtTime value", value);
             break;

[hongchan, 2016/05/20 21:14:07]

So what will happen after this break? It still returns a valid AudioParam object
at the end. Right?

1) You have 4 items in the array.
2) The 2nd item is out of range. So it breaks here. (meaning no more
verification for 3rd, 4th items)
3) Handler gets scheduled.
4) Return the AudioParam object.

Is this what we want? 
- So we warn user but we don't necessarily stop the operation?
- What if 3rd item is NaN?

[Raymond Toy, 2016/05/20 21:30:41]

No.  I was intending to scan the array just once.  More logic needed to do that.

         }
     }