Bug 223477

Summary:

Avoid heap allocation under AudioParamTimeline::processSetTargetFollowedByRamp()

Product:

WebKit

Reporter:

Chris Dumez <cdumez>

Component:

Web Audio

Assignee:

Chris Dumez <cdumez>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

cdumez, darin, eric.carlson, ews-watchlist, ggaren, glenn, jer.noble, peng.liu6, philipj, sergio, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

Bug Blocks:

223226

Attachments:

Description	Flags
Patch	none

Chris Dumez

Reported 2021-03-18 13:50:35 PDT

Avoid heap allocation under AudioParamTimeline::processSetTargetFollowedByRamp(): Thread 18 Crashed:: offline renderer 0 com.apple.JavaScriptCore 0x00000006a7bb82ce 0x6a7bb6000 + 8910 1 com.apple.JavaScriptCore 0x00000006a935ad5b 0x6a7bb6000 + 24792411 2 com.apple.JavaScriptCore 0x00000006a7bf5a0b 0x6a7bb6000 + 260619 3 com.apple.WebCore 0x000000068ab657a5 WebCore::AudioParamTimeline::ParamEvent::operator new(unsigned long) + 21 (AudioParamTimeline.h:67) 4 com.apple.WebCore 0x000000068ab65d09 WTF::UniqueRef<WebCore::AudioParamTimeline::ParamEvent> WTF::makeUniqueRefWithoutFastMallocCheck<WebCore::AudioParamTimeline::ParamEvent, WebCore::AudioParamTimeline::ParamEvent::Type, float&, WTF::Seconds&, int, WTF::Seconds, WTF::Vector<float, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, int, int, std::nullptr_t>(WebCore::AudioParamTimeline::ParamEvent::Type&&, float&, WTF::Seconds&, int&&, WTF::Seconds&&, WTF::Vector<float, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&, int&&, int&&, std::nullptr_t&&) + 105 (UniqueRef.h:38) 5 com.apple.WebCore 0x000000068ab59ba0 WTF::UniqueRef<WebCore::AudioParamTimeline::ParamEvent> WTF::makeUniqueRef<WebCore::AudioParamTimeline::ParamEvent, WebCore::AudioParamTimeline::ParamEvent::Type, float&, WTF::Seconds&, int, WTF::Seconds, WTF::Vector<float, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, int, int, std::nullptr_t>(WebCore::AudioParamTimeline::ParamEvent::Type&&, float&, WTF::Seconds&, int&&, WTF::Seconds&&, WTF::Vector<float, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&&, int&&, int&&, std::nullptr_t&&) + 304 (UniqueRef.h:45) 6 com.apple.WebCore 0x000000068ab55c00 WebCore::AudioParamTimeline::ParamEvent::createSetValueEvent(float, WTF::Seconds) + 160 (AudioParamTimeline.cpp:905) 7 com.apple.WebCore 0x000000068ab57dfc WebCore::AudioParamTimeline::processSetTargetFollowedByRamp(int, WebCore::AudioParamTimeline::ParamEvent*&, WebCore::AudioParamTimeline::ParamEvent::Type, unsigned long, double, double, float&) + 684 (AudioParamTimeline.cpp:803) 8 com.apple.WebCore 0x000000068ab573fc WebCore::AudioParamTimeline::valuesForFrameRangeImpl(unsigned long, unsigned long, float, float*, unsigned int, double, double) + 1212 (AudioParamTimeline.cpp:414) 9 com.apple.WebCore 0x000000068ab54652 WebCore::AudioParamTimeline::valuesForFrameRange(unsigned long, unsigned long, float, float, float, float*, unsigned int, double, double) + 178 (AudioParamTimeline.cpp:354) 10 com.apple.WebCore 0x000000068ab544cb WebCore::AudioParam::calculateTimelineValues(float*, unsigned int) + 219 (AudioParam.cpp:312) 11 com.apple.WebCore 0x000000068ab53fe9 WebCore::AudioParam::calculateFinalValues(float*, unsigned int, bool) + 233 (AudioParam.cpp:263) 12 com.apple.WebCore 0x000000068ab543e5 WebCore::AudioParam::calculateSampleAccurateValues(float*, unsigned int) + 245 (AudioParam.cpp:249) 13 com.apple.WebCore 0x000000068abcbdc7 WebCore::GainNode::process(unsigned long) + 503 (GainNode.cpp:84) 14 com.apple.WebCore 0x000000068ab2972e WebCore::AudioNode::processIfNecessary(unsigned long) + 462 (AudioNode.cpp:474) 15 com.apple.WebCore 0x000000068ab2bfd7 WebCore::AudioNodeOutput::pull(WebCore::AudioBus*, unsigned long) + 407 (AudioNodeOutput.cpp:120) 16 com.apple.WebCore 0x000000068ab2bda6 WebCore::AudioNodeInput::sumAllConnections(WebCore::AudioBus*, unsigned long) + 566 (AudioNodeInput.cpp:193) 17 com.apple.WebCore 0x000000068ab245e7 WebCore::AudioNodeInput::pull(WebCore::AudioBus*, unsigned long) + 295 (AudioNodeInput.cpp:221) 18 com.apple.WebCore 0x000000068ab24185 WebCore::AudioDestinationNode::render(WebCore::AudioBus*, WebCore::AudioBus*, unsigned long, WebCore::AudioIOPosition const&) + 469 (AudioDestinationNode.cpp:94) 19 com.apple.WebCore 0x000000068abe0d3d WebCore::OfflineAudioDestinationNode::offlineRender() + 877 (OfflineAudioDestinationNode.cpp:163)

Attachments
Patch (24.41 KB, patch) 2021-03-18 13:53 PDT, Chris Dumez	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Chris Dumez

Comment 1 2021-03-18 13:53:03 PDT

Created attachment 423646 [details] Patch

EWS

Comment 2 2021-03-18 16:39:09 PDT

Committed r274686: <https://commits.webkit.org/r274686> All reviewed patches have been landed. Closing bug and clearing flags on attachment 423646 [details].

Radar WebKit Bug Importer

Comment 3 2021-03-18 16:40:15 PDT

<rdar://problem/75597040>

Note You need to log in before you can comment on or make changes to this bug.