Throw exception if curve is too short for setValueCurveAtTime

third_party/WebKit/Source/modules/webaudio/AudioParamTimeline.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 176 matching lines @@
 
 void AudioParamTimeline::setValueCurveAtTime(DOMFloat32Array* curve, double time, double duration, ExceptionState& exceptionState)
 {
     ASSERT(isMainThread());
     ASSERT(curve);
 
     if (!isNonNegativeAudioParamTime(time, exceptionState)
         || !isPositiveAudioParamTime(duration, exceptionState, "Duration"))
         return;
 
+    if (curve->length() < 2) {
+        exceptionState.throwDOMException(
+            InvalidStateError,
+            ExceptionMessages::indexExceedsMinimumBound(
+                "curve length",
+                curve->length(),
+                2U));
+        return;
+    }
+
     insertEvent(ParamEvent::createSetValueCurveEvent(curve, time, duration), exceptionState);
 }
 
 void AudioParamTimeline::insertEvent(const ParamEvent& event, ExceptionState& exceptionState)
 {
     ASSERT(isMainThread());
 
     // Sanity check the event. Be super careful we're not getting infected with NaN or Inf. These
     // should have been handled by the caller.
     bool isValid = event.getType() < ParamEvent::LastType
@@ skipping 649 matching lines @@
     for (; writeIndex < numberOfValues; ++writeIndex)
         values[writeIndex] = value;
 
     // This value is used to set the .value attribute of the AudioParam.  it should be the last
     // computed value.
     return values[numberOfValues - 1];
 }
 
 } // namespace blink