Bug 302521 – REGRESSION (Safari 26): AudioData.copyTo() crashes the tab with valid conversion

• Status: RESOLVED
• Resolution: FIXED
• Component: Media

The following snippet crashes the tab, as of Safari Technology Preview 231, seems like code has not changed since.


```
const data = new AudioData({
	numberOfChannels: 3,
	data: new Float32Array([1, 1, 1]),
	format: 'f32',
	numberOfFrames: 1,
	sampleRate: 48000,
	timestamp: 0,
});

const dataBytes = new Float32Array(1);
data.copyTo(dataBytes, {planeIndex: 2, format: 'f32-planar'});
console.log(dataBytes);
```

It's a `pac violation` according to Console.app.

What is happening here?
We have interleaved audio with 3 channels. We would like to turn this into planar audio (spec says: "Conversion to f32-planar MUST always be supported").
The correct behavior would be to take every third element of the input array and copy that into the destination buffer.

Chrome correctly performs the conversion and returns `Float32Array([1])`.

[Alexey Proskuryakov]

This hits:

        RELEASE_ASSERT(sourcePlane.size() >= sampleIndexIncrement * samples + sampleOffset - 1);

[Radar WebKit Bug Importer]

<rdar://problem/164730320>

[Alexey Proskuryakov]

Created attachment 477397 [details]
test case

Same test as an attachment.

[Nipun Shukla]

Pull request: https://github.com/WebKit/WebKit/pull/55085

[EWS]

Committed 304728@main (3fe28c6ca996): <https://commits.webkit.org/304728@main>

Reviewed commits have been landed. Closing PR #55085 and removing active labels.