223228 2021-03-15 17:29:09 -0700 Avoid heap allocation in RemoteAudioDestinationProxy::renderQuantum() 2021-03-15 19:31:35 -0700 1 1 1 Unclassified WebKit Web Audio WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 223226 1 cdumez cdumez cdumez darin eric.carlson ews-watchlist ggaren glenn jer.noble peng.liu6 philipj sergio webkit-bug-importer oldest_to_newest 1739760 0 cdumez 2021-03-15 17:29:09 -0700 Avoid heap allocation in RemoteAudioDestinationProxy::renderQuantum() since this runs on the audio thread: Thread 11 Crashed:: RemoteAudioDestinationProxy render thread 3 com.apple.WebCore 0x00000005608bce75 WTF::FastMalloc::malloc(unsigned long) + 21 (FastMalloc.h:246) 4 com.apple.WebCore 0x00000005608bcdc2 bool WTF::VectorBufferBase<unsigned char, WTF::FastMalloc>::allocateBuffer<(WTF::FailureAction)0>(unsigned long) + 178 (Vector.h:301) 5 com.apple.WebCore 0x00000005608bcbe1 bool WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::reserveCapacity<(WTF::FailureAction)0>(unsigned long) + 113 (Vector.h:1195) 6 com.apple.WebCore 0x00000005608bcb10 bool WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::expandCapacity<(WTF::FailureAction)0>(unsigned long) + 112 (Vector.h:1056) 7 com.apple.WebCore 0x00000005608bc25d WTF::Vector<unsigned char, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::resize(unsigned long) + 141 (Vector.h:1102) 8 com.apple.WebCore 0x0000000564803e34 WebCore::WebAudioBufferList::setSampleCount(unsigned int) + 244 (WebAudioBufferList.cpp:99) 9 com.apple.WebKit 0x0000000551bd8910 WebKit::RemoteAudioDestinationProxy::renderQuantum() + 144 (RemoteAudioDestinationProxy.cpp:165) 10 com.apple.WebKit 0x0000000551c0161b WebKit::RemoteAudioDestinationProxy::startRenderingThread()::$_10::operator()() + 91 (RemoteAudioDestinationProxy.cpp:87) 11 com.apple.WebKit 0x0000000551c0158e WTF::Detail::CallableWrapper<WebKit::RemoteAudioDestinationProxy::startRenderingThread()::$_10, void>::call() + 30 (Function.h:52) 12 com.apple.JavaScriptCore 0x000000057fc68552 WTF::Function<void ()>::operator()() const + 130 (Function.h:83) 13 com.apple.JavaScriptCore 0x000000057fd1cba8 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 424 (Threading.cpp:181) 14 com.apple.JavaScriptCore 0x000000057fd28d48 WTF::wtfThreadEntryPoint(void*) + 24 (ThreadingPOSIX.cpp:241) 15 libsystem_pthread.dylib 0x00007fff20686954 _pthread_start + 224 16 libsystem_pthread.dylib 0x00007fff206824a7 thread_start + 15 1739761 1 423270 cdumez 2021-03-15 17:30:34 -0700 Created attachment 423270 Patch 1739792 2 ews-feeder 2021-03-15 19:01:19 -0700 Committed r274459: <https://commits.webkit.org/r274459> All reviewed patches have been landed. Closing bug and clearing flags on attachment 423270. 1739793 3 webkit-bug-importer 2021-03-15 19:02:14 -0700 <rdar://problem/75458755> 423270 2021-03-15 17:30:34 -0700 2021-03-15 19:01:21 -0700 Patch bug-223228-20210315173034.patch text/plain 2254 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjc0NDQxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDkzMmRiYTM1MWZhYTkyNzU0 M2YwYmMxNTc0NmU0MDQ4MmVmYmY0MzcuLmE0NGJjMTA5NGQ0MGI0ZWY4YzY3ZDE2YzVmYWU0OTkw ZTg1Mzc2NWMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTcgQEAKKzIwMjEtMDMtMTUgIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKworICAgICAgICBBdm9pZCBoZWFwIGFsbG9jYXRpb24g aW4gUmVtb3RlQXVkaW9EZXN0aW5hdGlvblByb3h5OjpyZW5kZXJRdWFudHVtKCkKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyMzIyOAorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEF2b2lkIGhlYXAgYWxsb2Nh dGlvbiBpbiBSZW1vdGVBdWRpb0Rlc3RpbmF0aW9uUHJveHk6OnJlbmRlclF1YW50dW0oKSBzaW5j ZSB0aGlzIHJ1bnMgb24gdGhlCisgICAgICAgIGF1ZGlvIHRocmVhZC4KKworICAgICAgICAqIFdl YlByb2Nlc3MvR1BVL21lZGlhL1JlbW90ZUF1ZGlvRGVzdGluYXRpb25Qcm94eS5jcHA6CisgICAg ICAgIChXZWJLaXQ6OlJlbW90ZUF1ZGlvRGVzdGluYXRpb25Qcm94eTo6Y29ubmVjdFRvR1BVUHJv Y2Vzcyk6CisgICAgICAgIChXZWJLaXQ6OlJlbW90ZUF1ZGlvRGVzdGluYXRpb25Qcm94eTo6cmVu ZGVyUXVhbnR1bSk6CisKIDIwMjEtMDMtMTUgIFBlciBBcm5lIFZvbGxhbiAgPHB2b2xsYW5AYXBw bGUuY29tPgogCiAgICAgICAgIEVuZm9yY2Ugc3ViY29tbWFuZCBmaWx0ZXJpbmcKZGlmZiAtLWdp dCBhL1NvdXJjZS9XZWJLaXQvV2ViUHJvY2Vzcy9HUFUvbWVkaWEvUmVtb3RlQXVkaW9EZXN0aW5h dGlvblByb3h5LmNwcCBiL1NvdXJjZS9XZWJLaXQvV2ViUHJvY2Vzcy9HUFUvbWVkaWEvUmVtb3Rl QXVkaW9EZXN0aW5hdGlvblByb3h5LmNwcAppbmRleCA2OWJiZThkMTBiOGZiYTJlM2FhNmJkMGMz MDViZjU0YzQ4Mzc5YWI5Li41NmFkNjA4NGE3ZjU1ZWQxYzQxY2Q3YTZiNmQ1ODEzN2E2NzI5MjRi IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvR1BVL21lZGlhL1JlbW90ZUF1 ZGlvRGVzdGluYXRpb25Qcm94eS5jcHAKKysrIGIvU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL0dQ VS9tZWRpYS9SZW1vdGVBdWRpb0Rlc3RpbmF0aW9uUHJveHkuY3BwCkBAIC0xMjQsNiArMTI0LDcg QEAgdm9pZCBSZW1vdGVBdWRpb0Rlc3RpbmF0aW9uUHJveHk6OmNvbm5lY3RUb0dQVVByb2Nlc3Mo KQogICAgIGdldEF1ZGlvU3RyZWFtQmFzaWNEZXNjcmlwdGlvbihzdHJlYW1Gb3JtYXQpOwogICAg IG1fcmluZ0J1ZmZlci0+YWxsb2NhdGUoc3RyZWFtRm9ybWF0LCBtX251bWJlck9mRnJhbWVzKTsK ICAgICBtX2F1ZGlvQnVmZmVyTGlzdCA9IG1ha2VVbmlxdWU8V2ViQ29yZTo6V2ViQXVkaW9CdWZm ZXJMaXN0PihzdHJlYW1Gb3JtYXQpOworICAgIG1fYXVkaW9CdWZmZXJMaXN0LT5zZXRTYW1wbGVD b3VudChXZWJDb3JlOjpBdWRpb1V0aWxpdGllczo6cmVuZGVyUXVhbnR1bVNpemUpOwogI2VuZGlm CiAKICAgICBzdGFydFJlbmRlcmluZ1RocmVhZCgpOwpAQCAtMTYyLDcgKzE2Myw2IEBAIHZvaWQg UmVtb3RlQXVkaW9EZXN0aW5hdGlvblByb3h5OjpyZW5kZXJRdWFudHVtKCkKICAgICBBU1NFUlQo IWlzTWFpblJ1bkxvb3AoKSk7CiAKICNpZiBQTEFURk9STShDT0NPQSkKLSAgICBtX2F1ZGlvQnVm ZmVyTGlzdC0+c2V0U2FtcGxlQ291bnQoV2ViQ29yZTo6QXVkaW9VdGlsaXRpZXM6OnJlbmRlclF1 YW50dW1TaXplKTsKICAgICBBdWRpb0Rlc3RpbmF0aW9uQ29jb2E6OnJlbmRlcihtX2N1cnJlbnRG cmFtZSAvIHN0YXRpY19jYXN0PGRvdWJsZT4obV9zYW1wbGVSYXRlKSwgbWFjaF9hYnNvbHV0ZV90 aW1lKCksIFdlYkNvcmU6OkF1ZGlvVXRpbGl0aWVzOjpyZW5kZXJRdWFudHVtU2l6ZSwgbV9hdWRp b0J1ZmZlckxpc3QtPmxpc3QoKSk7CiAgICAgbV9yaW5nQnVmZmVyLT5zdG9yZShtX2F1ZGlvQnVm ZmVyTGlzdC0+bGlzdCgpLCBXZWJDb3JlOjpBdWRpb1V0aWxpdGllczo6cmVuZGVyUXVhbnR1bVNp emUsIG1fY3VycmVudEZyYW1lKTsKICAgICBtX2N1cnJlbnRGcmFtZSArPSBXZWJDb3JlOjpBdWRp b1V0aWxpdGllczo6cmVuZGVyUXVhbnR1bVNpemU7Cg==