Detach buffer in decodeAudioData

third_party/WebKit/Source/modules/webaudio/BaseAudioContext.cpp

Index: third_party/WebKit/Source/modules/webaudio/BaseAudioContext.cpp
diff --git a/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.cpp b/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.cpp
index d0acd8dbd40e27c20f1486655552d659e763b0ab..10495076962bd6e25b64ebb21e473f15c791ddc2 100644
--- a/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.cpp
@@ -284,9 +284,26 @@ ScriptPromise BaseAudioContext::decodeAudioData(
 
   DCHECK_GT(rate, 0);
 
-  m_decodeAudioResolvers.insert(resolver);
-  m_audioDecoder.decodeAsync(audioData, rate, successCallback, errorCallback,
-                             resolver, this);
+  if (audioData->isNeutered() || audioData->isShared()) {
+    // If audioData is detached (neutered) or is a SharedArrayBuffer,
+    // we need to reject the promise with error TypeError.
+    DOMException* error = DOMException::create(
+        V8TypeError, "Cannot decode detached or shared ArrayBuffer");

[Raymond Toy, 2017/03/15 15:03:50]

Can't actually create an exception of type V8TypeError. (It's causing a crash in
create.)

Maybe DataCloneError would be more appropriate?

+    resolver->reject(error);
+    if (errorCallback) {
+      errorCallback->handleEvent(error);
+    }
+  } else {
+    // Detach the audio array buffer from the main thread and start
+    // async decoding of the data.
+    WTF::ArrayBufferContents buf;
+    audioData->transfer(buf);
+    DOMArrayBuffer* audio = DOMArrayBuffer::create(buf);
+
+    m_decodeAudioResolvers.insert(resolver);
+    m_audioDecoder.decodeAsync(audio, rate, successCallback, errorCallback,
+                               resolver, this);
+  }
 
   return promise;
 }