Fix crash when the OfflineAudioContext constructor is given 0 as numberOfFrames

Source/modules/webaudio/AudioContext.cpp

 /*
  * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 136 matching lines @@
     , m_isOfflineContext(true)
     , m_activeSourceCount(0)
 {
     constructCommon();
 
     // FIXME: the passed in sampleRate MUST match the hardware sample-rate since HRTFDatabaseLoader is a singleton.
     m_hrtfDatabaseLoader = HRTFDatabaseLoader::createAndLoadAsynchronouslyIfNecessary(sampleRate);
 
     // Create a new destination for offline rendering.
     m_renderTarget = AudioBuffer::create(numberOfChannels, numberOfFrames, sampleRate);
+    ASSERT(m_renderTarget);
     m_destinationNode = OfflineAudioDestinationNode::create(this, m_renderTarget.get());
+    ASSERT(m_destinationNode);

[Raymond Toy (Google), 2013/10/11 20:04:40]

Did these two asserts catch the crash?

I'm just concerned that debug code will find this, but release code will not and
crash in some strange place.

It would be nice if we threw an error in these cases too.

[Inactive, 2013/10/11 20:14:30]

Yes, these assertions would have caught the crash. The issue was that
AudioBuffer::create() would fail due to bad input and return 0.
Then the OfflineAudioDestinationNode constructor would try the use the null
renderTarget.

It is up to the factory methods to validate the input properly so that the
constructor does not fail. I think those assertion are useful indicators that
the factory did not validate properly. We cannot throw js exceptions here, they
should be thrown earlier in the factory.

 }
 
 void AudioContext::constructCommon()
 {
     ScriptWrappable::init(this);
     // According to spec AudioContext must die only after page navigate.
     // Lets mark it as ActiveDOMObject with pending activity and unmark it in clear method.
     setPendingActivity(this);
 
     FFTFrame::initialize();
@@ skipping 927 matching lines @@
 }
 
 void AudioContext::decrementActiveSourceCount()
 {
     atomicDecrement(&m_activeSourceCount);
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(WEB_AUDIO)