Clamp loopStart to lie in the buffer bounds

third_party/WebKit/Source/modules/webaudio/AudioBufferSourceNode.cpp

 /*
  * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 208 matching lines @@
         // Convert from seconds to sample-frames.
         double loopStartFrame = m_loopStart * buffer()->sampleRate();
         double loopEndFrame = m_loopEnd * buffer()->sampleRate();
 
         virtualEndFrame = std::min(loopEndFrame, virtualEndFrame);
         virtualDeltaFrames = virtualEndFrame - loopStartFrame;
     }
 
     // If we're looping and the offset (virtualReadIndex) is past the end of the loop, wrap back to
     // the beginning of the loop. For other cases, nothing needs to be done.
-    if (loop() && m_virtualReadIndex >= virtualEndFrame)
+    if (loop() && m_virtualReadIndex >= virtualEndFrame) {
         m_virtualReadIndex = (m_loopStart < 0) ? 0 : (m_loopStart * buffer()->sampleRate());
+        m_virtualReadIndex = std::min(m_virtualReadIndex, static_cast<double>(bufferLength - 1));
+    }
 
     double computedPlaybackRate = computePlaybackRate();
 
     // Sanity check that our playback rate isn't larger than the loop size.
     if (computedPlaybackRate > virtualDeltaFrames)
         return false;
 
     // Get local copy.
     double virtualReadIndex = m_virtualReadIndex;
 
@@ skipping 13 matching lines @@
         && virtualDeltaFrames == floor(virtualDeltaFrames)
         && virtualEndFrame == floor(virtualEndFrame)) {
         unsigned readIndex = static_cast<unsigned>(virtualReadIndex);
         unsigned deltaFrames = static_cast<unsigned>(virtualDeltaFrames);
         endFrame = static_cast<unsigned>(virtualEndFrame);
         while (framesToProcess > 0) {
             int framesToEnd = endFrame - readIndex;
             int framesThisTime = std::min(framesToProcess, framesToEnd);
             framesThisTime = std::max(0, framesThisTime);
 
+            DCHECK_LE(writeIndex + framesThisTime, destinationLength);
+            DCHECK_LE(readIndex + framesThisTime, bufferLength);
+
             for (unsigned i = 0; i < numberOfChannels; ++i)
                 memcpy(destinationChannels[i] + writeIndex, sourceChannels[i] + readIndex, sizeof(float) * framesThisTime);
 
             writeIndex += framesThisTime;
             readIndex += framesThisTime;
             framesToProcess -= framesThisTime;
 
             // It can happen that framesThisTime is 0. DCHECK that we will actually exit the loop in
             // this case.  framesThisTime is 0 only if readIndex >= endFrame;
             DCHECK(framesThisTime ? true : readIndex >= endFrame);
@@ skipping 411 matching lines @@
 {
     audioBufferSourceHandler().start(when, grainOffset, exceptionState);
 }
 
 void AudioBufferSourceNode::start(double when, double grainOffset, double grainDuration, ExceptionState& exceptionState)
 {
     audioBufferSourceHandler().start(when, grainOffset, grainDuration, exceptionState);
 }
 
 } // namespace blink