Bug 223529 – Avoid heap allocation under AudioNodeInput::disable() / AudioNodeInput::enable()

• Status: RESOLVED
• Resolution: FIXED
• Component: Web Audio

[Chris Dumez]

Avoid heap allocation under AudioNodeInput::disable() / AudioNodeInput::enable():

Thread 10 Crashed:: offline renderer
0   com.apple.JavaScriptCore            0x0000000177be026e WTFCrash + 14 (Assertions.cpp:295)
1   com.apple.JavaScriptCore            0x0000000179382cfb WTFCrashWithInfo(int, char const*, char const*, int) + 27 (Assertions.h:671)
2   com.apple.JavaScriptCore            0x0000000177c1d9ab WTF::fastMalloc(unsigned long) + 235 (FastMalloc.cpp:524)
3   com.apple.JavaScriptCore            0x0000000177c1d895 WTF::fastZeroedMalloc(unsigned long) + 21 (FastMalloc.cpp:114)
4   com.apple.WebCore                   0x0000000158917e85 WTF::FastMalloc::zeroedMalloc(unsigned long) + 21 (FastMalloc.h:284)
5   com.apple.WebCore                   0x000000015ab37c53 WTF::HashTable<WebCore::AudioNodeOutput*, WebCore::AudioNodeOutput*, WTF::IdentityExtractor, WTF::DefaultHash<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*> >::allocateTable(unsigned int) + 35 (HashTable.h:1215)
6   com.apple.WebCore                   0x000000015ab3795a WTF::HashTable<WebCore::AudioNodeOutput*, WebCore::AudioNodeOutput*, WTF::IdentityExtractor, WTF::DefaultHash<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*> >::rehash(unsigned int, WebCore::AudioNodeOutput**) + 74 (HashTable.h:1327)
7   com.apple.WebCore                   0x000000015ab37358 WTF::HashTable<WebCore::AudioNodeOutput*, WebCore::AudioNodeOutput*, WTF::IdentityExtractor, WTF::DefaultHash<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*> >::expand(WebCore::AudioNodeOutput**) + 120 (HashTable.h:1249)
8   com.apple.WebCore                   0x000000015ab522f3 WTF::HashTableAddResult<WTF::HashTableIterator<WebCore::AudioNodeOutput*, WebCore::AudioNodeOutput*, WTF::IdentityExtractor, WTF::DefaultHash<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*> > > WTF::HashTable<WebCore::AudioNodeOutput*, WebCore::AudioNodeOutput*, WTF::IdentityExtractor, WTF::DefaultHash<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*> >::add<WTF::IdentityHashTranslator<WTF::HashTraits<WebCore::AudioNodeOutput*>, WTF::DefaultHash<WebCore::AudioNodeOutput*> >, WebCore::AudioNodeOutput* const&, WebCore::AudioNodeOutput* const&>(WebCore::AudioNodeOutput* const&, WebCore::AudioNodeOutput* const&) + 115 (HashTable.h:934)
9   com.apple.WebCore                   0x000000015ab5226a WTF::HashTable<WebCore::AudioNodeOutput*, WebCore::AudioNodeOutput*, WTF::IdentityExtractor, WTF::DefaultHash<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*> >::add(WebCore::AudioNodeOutput* const&) + 74 (HashTable.h:466)
10  com.apple.WebCore                   0x000000015ab3223b WTF::HashSet<WebCore::AudioNodeOutput*, WTF::DefaultHash<WebCore::AudioNodeOutput*>, WTF::HashTraits<WebCore::AudioNodeOutput*> >::add(WebCore::AudioNodeOutput* const&) + 43 (HashSet.h:239)
11  com.apple.WebCore                   0x000000015ab3217a WebCore::AudioNodeInput::disable(WebCore::AudioNodeOutput*) + 298 (AudioNodeInput.cpp:97)
12  com.apple.WebCore                   0x000000015ab30eda WebCore::AudioNodeOutput::disable() + 346 (AudioNodeOutput.cpp:230)
13  com.apple.WebCore                   0x000000015ab30d62 WebCore::AudioNode::disableOutputs() + 98 (AudioNode.cpp:553)
14  com.apple.WebCore                   0x000000015ab30cf1 WebCore::AudioNode::disableOutputsIfNecessary() + 97 (AudioNode.cpp:545)
15  com.apple.WebCore                   0x000000015ab31228 WebCore::AudioNode::decrementConnectionCountWithLock() + 312 (AudioNode.cpp:616)
16  com.apple.WebCore                   0x000000015ab31014 WebCore::AudioNode::decrementConnectionCount() + 132 (AudioNode.cpp:587)
17  com.apple.WebCore                   0x000000015ab4f17e WebCore::AudioNodeConnectionRefDerefTraits<WebCore::AudioNode>::derefIfNotNull(WebCore::AudioNode*) + 46 (AudioNode.h:284)
18  com.apple.WebCore                   0x000000015ab4f149 WTF::RefPtr<WebCore::AudioNode, WTF::RawPtrTraits<WebCore::AudioNode>, WebCore::AudioNodeConnectionRefDerefTraits<WebCore::AudioNode> >::~RefPtr() + 41 (RefPtr.h:73)
19  com.apple.WebCore                   0x000000015ab4f115 WTF::RefPtr<WebCore::AudioNode, WTF::RawPtrTraits<WebCore::AudioNode>, WebCore::AudioNodeConnectionRefDerefTraits<WebCore::AudioNode> >::~RefPtr() + 21 (RefPtr.h:73)
20  com.apple.WebCore                   0x000000015ab8c8d7 unsigned int WTF::Vector<WTF::RefPtr<WebCore::AudioNode, WTF::RawPtrTraits<WebCore::AudioNode>, WebCore::AudioNodeConnectionRefDerefTraits<WebCore::AudioNode> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::removeAllMatching<bool (WTF::RefPtr<WebCore::AudioNode, WTF::RawPtrTraits<WebCore::AudioNode>, WebCore::AudioNodeConnectionRefDerefTraits<WebCore::AudioNode> > const&)>(bool  const(&)(WTF::RefPtr<WebCore::AudioNode, WTF::RawPtrTraits<WebCore::AudioNode>, WebCore::AudioNodeConnectionRefDerefTraits<WebCore::AudioNode> > const&), unsigned long) + 263 (Vector.h:1512)
21  com.apple.WebCore                   0x000000015ab89cf6 WebCore::BaseAudioContext::derefFinishedSourceNodes() + 278 (BaseAudioContext.cpp:586)
22  com.apple.WebCore                   0x000000015ab8d77c WebCore::BaseAudioContext::handlePostRenderTasks() + 156 (BaseAudioContext.cpp:734)
23  com.apple.WebCore                   0x000000015ab2ad00 WebCore::AudioDestinationNode::render(WebCore::AudioBus*, WebCore::AudioBus*, unsigned long, WebCore::AudioIOPosition const&) + 576 (AudioDestinationNode.cpp:107)
24  com.apple.WebCore                   0x000000015abe66fd WebCore::OfflineAudioDestinationNode::offlineRender() + 877 (OfflineAudioDestinationNode.cpp:163)

[Chris Dumez]

Created attachment 423762 [details]
Patch

[Chris Dumez]

Created attachment 423769 [details]
Patch

[Peng Liu]

Comment on attachment 423769 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=423769&action=review

> Source/WebCore/Modules/webaudio/AudioSummingJunction.cpp:135
> +        m_pendingRenderingOutputs->updatedEnabledState(output);

Nit. Regarding "m_pendingRenderingOutputs." and "m_pendingRenderingOutputs->", I believe they are working. But they look strange at first glance. :-)

> Source/WebCore/Modules/webaudio/AudioSummingJunction.h:69
> +            bool operator==(AudioNodeOutput* other) const { return output == other; }

const AudioNodeOutput* other?

[Chris Dumez]

(In reply to Peng Liu from comment #3)
> Comment on attachment 423769 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=423769&action=review
> 
> > Source/WebCore/Modules/webaudio/AudioSummingJunction.cpp:135
> > +        m_pendingRenderingOutputs->updatedEnabledState(output);
> 
> Nit. Regarding "m_pendingRenderingOutputs." and
> "m_pendingRenderingOutputs->", I believe they are working. But they look
> strange at first glance. :-)

What looks strange? It is an Optional<> now so I need to `->` instead of `.`

> 
> > Source/WebCore/Modules/webaudio/AudioSummingJunction.h:69
> > +            bool operator==(AudioNodeOutput* other) const { return output == other; }
> 
> const AudioNodeOutput* other?

OK.

[Peng Liu]

Comment on attachment 423769 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=423769&action=review

>>> Source/WebCore/Modules/webaudio/AudioSummingJunction.cpp:135
>>> +        m_pendingRenderingOutputs->updatedEnabledState(output);
>> 
>> Nit. Regarding "m_pendingRenderingOutputs." and "m_pendingRenderingOutputs->", I believe they are working. But they look strange at first glance. :-)
> 
> What looks strange? It is an Optional<> now so I need to `->` instead of `.`

At first glance I was surprised by the "m_pendingRenderingOutputs." in the "if" branch and "m_pendingRenderingOutputs->" in the "else" branch. But it is not an issue actually.
:-)

[Chris Dumez]

Created attachment 423789 [details]
Patch

[EWS]

commit-queue failed to commit attachment 423789 [details] to WebKit repository. To retry, please set cq+ flag again.

[EWS]

Committed r274767: <https://commits.webkit.org/r274767>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 423789 [details].

[Radar WebKit Bug Importer]

<rdar://problem/75701704>