chromium/third_party/blink/web_tests/webaudio/AudioParam/cancel-values-crash-913217.html

<!DOCTYPE html>
<html>
  <head>
    <title>
      Test if canceling events after setTargetAtTime crashes
    </title>
    <script src="../../resources/testharness.js"></script>
    <script src="../../resources/testharnessreport.js"></script>
    <script src="../resources/audit-util.js"></script>
    <script src="../resources/audit.js"></script>
  </head>
  <body>
    <script id="layout-test-code">
      // Arbitrary parameters for the offline context.
      const sampleRate = 48000;
      const renderDuration = 1;
      const channels = 2;
      const renderFrames = renderDuration * sampleRate;

      const audit = Audit.createTaskRunner();

      audit.define('crash', (task, should) => {
        const context =
            new OfflineAudioContext(channels, renderFrames, sampleRate);
        const source = context.createConstantSource();
        const analyser = context.createAnalyser();
        source.connect(analyser);

        // Scheduling the following at an earlier time than above causes the
        // page to crash in 73.0.3638.0. See crbug.com/913217.
        source.offset.setValueAtTime(1, context.currentTime);
        source.offset.setTargetAtTime(0, context.currentTime + 2, 0.00001);
        source.offset.cancelAndHoldAtTime(context.currentTime + 1.99999);

        source.start(context.currentTime);

        context.startRendering().then(() => {
          // Should finish without a crash.
          task.done();
        });
      });

      audit.run();
    </script>
  </body>
</html>