1 files changed, 21 insertions, 15 deletions

diff --git a/chromium/third_party/blink/renderer/modules/webaudio/audio_param_timeline.cc b/chromium/third_party/blink/renderer/modules/webaudio/audio_param_timeline.cc
index cd7ad2e7b64..a16b9ac204c 100644
--- a/chromium/third_party/blink/renderer/modules/webaudio/audio_param_timeline.cc
+++ b/chromium/third_party/blink/renderer/modules/webaudio/audio_param_timeline.cc
@@ -969,9 +969,9 @@ float AudioParamTimeline::ValuesForFrameRangeImpl(size_t start_frame,
       fill_to_end_frame = static_cast<size_t>(ceil(time2 * sample_rate));
 
     DCHECK_GE(fill_to_end_frame, start_frame);
-    size_t fill_to_frame = fill_to_end_frame - start_frame;
-    fill_to_frame =
-        std::min(fill_to_frame, static_cast<size_t>(number_of_values));
+    unsigned fill_to_frame =
+        static_cast<unsigned>(fill_to_end_frame - start_frame);
+    fill_to_frame = std::min(fill_to_frame, number_of_values);
 
     const AutomationState current_state = {
         number_of_values,
@@ -1089,15 +1089,15 @@ std::tuple<size_t, unsigned> AudioParamTimeline::HandleFirstEvent(
   if (first_event_time > start_frame / sample_rate) {
     // |fillToFrame| is an exclusive upper bound, so use ceil() to compute the
     // bound from the firstEventTime.
-    size_t fill_to_frame = end_frame;
+    size_t fill_to_end_frame = end_frame;
     double first_event_frame = ceil(first_event_time * sample_rate);
     if (end_frame > first_event_frame)
-      fill_to_frame = static_cast<size_t>(first_event_frame);
-    DCHECK_GE(fill_to_frame, start_frame);
+      fill_to_end_frame = first_event_frame;
+    DCHECK_GE(fill_to_end_frame, start_frame);
 
-    fill_to_frame -= start_frame;
-    fill_to_frame =
-        std::min(fill_to_frame, static_cast<size_t>(number_of_values));
+    unsigned fill_to_frame =
+        static_cast<unsigned>(fill_to_end_frame - start_frame);
+    fill_to_frame = std::min(fill_to_frame, number_of_values);
     write_index =
         FillWithDefault(values, default_value, fill_to_frame, write_index);
 
@@ -1316,7 +1316,8 @@ AudioParamTimeline::HandleCancelValues(const ParamEvent* current_event,
   ParamEvent::Type next_event_type =
       next_event ? next_event->GetType() : ParamEvent::kLastType;
 
-  if (next_event && next_event->GetType() == ParamEvent::kCancelValues) {
+  if (next_event && next_event->GetType() == ParamEvent::kCancelValues &&
+      next_event->SavedEvent()) {
     float value1 = current_event->Value();
     double time1 = current_event->Time();
 
@@ -1412,7 +1413,12 @@ std::tuple<size_t, float, unsigned> AudioParamTimeline::ProcessLinearRamp(
   auto sample_rate = current_state.sample_rate;
 
   double delta_time = time2 - time1;
-  float k = delta_time > 0 ? 1 / delta_time : 0;
+  DCHECK_GE(delta_time, 0);
+  // Since delta_time is a double, 1/delta_time can easily overflow a float.
+  // Thus, if delta_time is close enough to zero (less than float min), treat it
+  // as zero.
+  float k =
+      delta_time <= std::numeric_limits<float>::min() ? 0 : 1 / delta_time;
   const float value_delta = value2 - value1;
 #if defined(ARCH_CPU_X86_FAMILY)
   if (fill_to_frame > write_index) {
@@ -1703,10 +1709,10 @@ std::tuple<size_t, float, unsigned> AudioParamTimeline::ProcessSetValueCurve(
   // has not yet started. In this case, |fillToFrame| is clipped to
   // |time1|+|duration| above, but |startFrame| will keep increasing
   // (because the current time is increasing).
-  fill_to_frame =
-      (fill_to_end_frame < start_frame) ? 0 : fill_to_end_frame - start_frame;
-  fill_to_frame =
-      std::min(fill_to_frame, static_cast<size_t>(number_of_values));
+  fill_to_frame = (fill_to_end_frame < start_frame)
+                      ? 0
+                      : static_cast<unsigned>(fill_to_end_frame - start_frame);
+  fill_to_frame = std::min(fill_to_frame, number_of_values);
 
   // Index into the curve data using a floating-point value.
   // We're scaling the number of curve points by the duration (see