content/media/AudioChannelFormat.cpp:85 83 if (inputChannelCount < CUSTOM_CHANNEL_LAYOUTS && 84 outputChannelCount <= CUSTOM_CHANNEL_LAYOUTS) { 85 const UpMixMatrix& m = gUpMixMatrices[ 86 gMixingMatrixIndexByChannels[inputChannelCount - 1] + 87 outputChannelCount - inputChannelCount - 1]; Tested with http://hg.mozilla.org/integration/mozilla-inbound/rev/a24cbd51b6f7 + https://bugzilla.mozilla.org/show_bug.cgi?id=865253

Somebody (me?) made the mistake of not checking for empty channel data here...

Comment on attachment 790978 [details] [diff] [review] Patch (v1) This is a bug in Web Audio, which affects Firefox 25 and 26. The fix is very simple and very safe. With enough effort, one could perhaps construct a test case based on the fix, but I don't think that's a severe issue since this bug doesn't affect any stable channels.

Comment on attachment 790978 [details] [diff] [review] Patch (v1) I'll ignore the lack of a security rating here but it would be good to have one.

(In reply to Al Billings [:abillings] from comment #4) > Comment on attachment 790978 [details] [diff] [review] > Patch (v1) > > I'll ignore the lack of a security rating here but it would be good to have > one. Marking this as sec-moderate. Based on comment 3 I presume that this bug got not introduced with the applied patch for the Oscillator node.

(In reply to Christoph Diehl [:cdiehl] from comment #5) > (In reply to Al Billings [:abillings] from comment #4) > > Comment on attachment 790978 [details] [diff] [review] > > Patch (v1) > > > > I'll ignore the lack of a security rating here but it would be good to have > > one. > > Marking this as sec-moderate. I think that's fair. > Based on comment 3 I presume that this bug got > not introduced with the applied patch for the Oscillator node. No, it wasn't. This is a bug in the general mixing code that we use for all kinds of AudioNode connections.