Check if |SavedEvent| exists handling cancel values

In AudioParamTimeline::HandleCancelValues() function, the code expects
the |saved_event| pointer from the next event to be non-null. There are
corner cases where this is not true.

Adding one more check on the saved event pointer fixes the crash.
Locally confirmed the attached web test crashes without this fix.

Bug: 913217
Test: webaudio/AudioParam/cancel-values-crash-913217.html
Change-Id: I4760b939534ef92a2475087540e17c8abc784b3b
Reviewed-by: Kentaro Hara <>
Commit-Queue: Hongchan Choi <>
Cr-Commit-Position: refs/heads/master@{#616107}
3 files changed