Crash in CopyFromChannelMethod

[pilgrim-brave]

0   libbase.dylib                       0x0000000113babfbf base::debug::CollectStackTrace(void**, unsigned long) + 31
1   libbase.dylib                       0x000000011385cd0b base::debug::StackTrace::StackTrace(unsigned long) + 75
2   libbase.dylib                       0x000000011385cd8d base::debug::StackTrace::StackTrace(unsigned long) + 29
3   libbase.dylib                       0x000000011385cd68 base::debug::StackTrace::StackTrace() + 40
4   libbase.dylib                       0x0000000113babe31 base::debug::(anonymous namespace)::StackDumpSignalHandler(int, __siginfo*, void*) + 1409
5   libsystem_platform.dylib            0x00007fff60afcf5a _sigtramp + 26
6   ???                                 0x0000000000000000 0x0 + 0
7   libblink_modules.dylib              0x00000001b104a965 blink::audio_buffer_v8_internal::CopyFromChannelMethod(v8::FunctionCallbackInfo<v8::Value> const&) + 3125
8   libblink_modules.dylib              0x00000001b1049d25 blink::V8AudioBuffer::CopyFromChannelMethodCallback(v8::FunctionCallbackInfo<v8::Value> const&) + 149
9   libv8.dylib                         0x000000010f59e95f v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo) + 927
10  libv8.dylib                         0x000000010f59ca44 v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) + 1700
11  libv8.dylib                         0x000000010f59a946 v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) + 502
12  libv8.dylib                         0x000000010f59a448 v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) + 152
13  libv8.dylib                         0x000000010f0e185f Builtins_CEntry_Return1_DontSaveFPRegs_ArgvOnStack_BuiltinExit + 63
[end of stack trace]```

[kjozwiak]

@fmarier @pilgrim-brave could we please get some STR/more information on this issue so QA can make sure it's working on Nightly before this is uplifted into 1.9.x and 1.8.x? Unless there's no STR and there's no way of QAing it. If that's the case, please add the QA/No labels.

If the STR are security sensitive, please ping me the STR so I can share with the QA team.

[kjozwiak]

@LaurenWags @btlechowski @GeetaSarvadnya lets make sure this gets QA'd on the following platforms:

• macOS 10.13 (High Sierra), macOS 10.14 (Mojave), macOS 10.15 (Catalina)
• Win 10, Win 8.1 and Win 7

Due to this being a security issue, want to make sure it works on all platforms. Cases should be easy enough so it doesn't take too long.

[kjozwiak]

Verification PASSED on macOS 10.15.4 x64 using the following build:

Brave | 1.8.89 Chromium: 81.0.4044.129 (Official Build) (64-bit)
-- | --
Revision | 3d71af9f5704a40b85806f4d08925db24605ba25-refs/branch-heads/4044@{#979}
OS | macOS Version 10.15.4 (Build 19E287)

• ensured that clicking in Crash didn't crash the webview/tab as per Fix buffer overflow in AudioBuffer::copyFromChannel brave-core#5427 (comment).

---

Verification PASSED on macOS 10.13.6 x64 using the following build:

Brave | 1.8.89 Chromium: 81.0.4044.129 (Official Build) (64-bit)
-- | --
Revision | 3d71af9f5704a40b85806f4d08925db24605ba25-refs/branch-heads/4044@{#979}
OS | macOS Version 10.13.6 (Build 17G11023)

• ensured that clicking in Crash didn't crash the webview/tab as per Fix buffer overflow in AudioBuffer::copyFromChannel brave-core#5427 (comment).

---

Verification PASSED on Win 8.1 x64 using the following build:

Brave | 1.8.89 Chromium: 81.0.4044.129 (Official Build) (64-bit)
-- | --
Revision | 3d71af9f5704a40b85806f4d08925db24605ba25-refs/branch-heads/4044@{#979}
OS | Windows 8.1 (Build 9600.19653)

• ensured that clicking in Crash didn't crash the webview/tab as per Fix buffer overflow in AudioBuffer::copyFromChannel brave-core#5427 (comment).

---

Verification PASSED on Win 8.1 x86 using the following build:

Brave | 1.8.89 Chromium: 81.0.4044.129 (Official Build) (32-bit)
-- | --
Revision | 3d71af9f5704a40b85806f4d08925db24605ba25-refs/branch-heads/4044@{#979}
OS | Windows 8.1 (Build 9600.19653)

• ensured that clicking in Crash didn't crash the webview/tab as per Fix buffer overflow in AudioBuffer::copyFromChannel brave-core#5427 (comment).

---

Verification passed on

Brave | 1.8.89 Chromium: 81.0.4044.129 (Official Build) (64-bit)
-- | --
Revision | 3d71af9f5704a40b85806f4d08925db24605ba25-refs/branch-heads/4044@{#979}
OS | Windows 10 OS Version 1803 (Build 17134.1006)

• ensured that clicking in Crash didn't crash the webview/tab as per Fix buffer overflow in AudioBuffer::copyFromChannel brave-core#5427 (comment).

---

Verification PASSED on Win 10 x86 using the following build:

Brave | 1.8.89 Chromium: 81.0.4044.129 (Official Build) (32-bit)
-- | --
Revision | 3d71af9f5704a40b85806f4d08925db24605ba25-refs/branch-heads/4044@{#979}
OS | Windows 10 OS Version 1909 (Build 18363.815)

• ensured that clicking in Crash didn't crash the webview/tab as per Fix buffer overflow in AudioBuffer::copyFromChannel brave-core#5427 (comment).

Verification passed on

Brave	1.8.89 Chromium: 81.0.4044.129 (Official Build) (64-bit)
Revision	3d71af9f5704a40b85806f4d08925db24605ba25-refs/branch-heads/4044@{#979}
OS	Ubuntu 18.04 LTS

• verified that clicking in Crash didn't crash the webview/tab as per Fix buffer overflow in AudioBuffer::copyFromChannel brave-core#5427 (comment).

Verification passed on

Brave	1.8.89 Chromium: 81.0.4044.129 (Official Build) (64-bit)
Revision	3d71af9f5704a40b85806f4d08925db24605ba25-refs/branch-heads/4044@{#979}
OS	Windows 7 Service Pack 1 (Build 7601.24544)

Verification passed on

Brave	1.8.89 Chromium: 81.0.4044.129 (Official Build) (32-bit)
Revision	3d71af9f5704a40b85806f4d08925db24605ba25-refs/branch-heads/4044@{#979}
OS	Windows 7 Service Pack 1

---

Verification PASSED on macOS 10.14.6 x64 using the following build:

Brave | 1.8.90 Chromium: 81.0.4044.129 (Official Build) (64-bit)
-- | --
Revision | 3d71af9f5704a40b85806f4d08925db24605ba25-refs/branch-heads/4044@{#979}
OS | macOS Version 10.14.6 (Build 18G3020)

• ensured that clicking in Crash didn't crash the webview/tab as per Fix buffer overflow in AudioBuffer::copyFromChannel brave-core#5427 (comment).