Skip to content

Commit 26affb1

Browse files
cdumezcdumez
committed
Crash in AudioBuffer::sampleRate()
https://bugs.webkit.org/show_bug.cgi?id=218603 Reviewed by Geoffrey Garen. Source/WebCore: Have OfflineAudioDestinationNode store the sample rate instead of getting it from the render buffer. It is possible for an OfflineAudioContext to have no rendering buffer when constructing this rendering buffer fails (e.g. because the length is too large). Test: webaudio/OfflineAudioContext-bad-buffer-crash.html * Modules/webaudio/AudioContext.cpp: (WebCore::AudioContext::AudioContext): * Modules/webaudio/AudioContext.h: * Modules/webaudio/AudioDestinationNode.cpp: (WebCore::AudioDestinationNode::AudioDestinationNode): * Modules/webaudio/AudioDestinationNode.h: * Modules/webaudio/BaseAudioContext.cpp: (WebCore::BaseAudioContext::BaseAudioContext): * Modules/webaudio/BaseAudioContext.h: * Modules/webaudio/DefaultAudioDestinationNode.cpp: (WebCore::DefaultAudioDestinationNode::DefaultAudioDestinationNode): * Modules/webaudio/DefaultAudioDestinationNode.h: * Modules/webaudio/OfflineAudioContext.cpp: (WebCore::OfflineAudioContext::OfflineAudioContext): (WebCore::OfflineAudioContext::create): * Modules/webaudio/OfflineAudioContext.h: * Modules/webaudio/OfflineAudioDestinationNode.cpp: (WebCore::OfflineAudioDestinationNode::OfflineAudioDestinationNode): * Modules/webaudio/OfflineAudioDestinationNode.h: * Modules/webaudio/WebKitAudioContext.cpp: (WebCore::WebKitAudioContext::WebKitAudioContext): * Modules/webaudio/WebKitAudioContext.h: * Modules/webaudio/WebKitOfflineAudioContext.cpp: (WebCore::WebKitOfflineAudioContext::WebKitOfflineAudioContext): (WebCore::WebKitOfflineAudioContext::create): * Modules/webaudio/WebKitOfflineAudioContext.h: LayoutTests: Add layout test coverage. * webaudio/OfflineAudioContext-bad-buffer-crash-expected.txt: Added. * webaudio/OfflineAudioContext-bad-buffer-crash.html: Added. Canonical link: https://commits.webkit.org/231287@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@269475 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 60061f8 commit 26affb1

20 files changed

Lines changed: 107 additions & 30 deletions

‎LayoutTests/ChangeLog‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
1+
2020-11-05 Chris Dumez <cdumez@apple.com>
2+
3+
Crash in AudioBuffer::sampleRate()
4+
https://bugs.webkit.org/show_bug.cgi?id=218603
5+
6+
Reviewed by Geoffrey Garen.
7+
8+
Add layout test coverage.
9+
10+
* webaudio/OfflineAudioContext-bad-buffer-crash-expected.txt: Added.
11+
* webaudio/OfflineAudioContext-bad-buffer-crash.html: Added.
12+
113
2020-11-05 Ryan Haddad <ryanhaddad@apple.com>
214

315
fast/forms/search/search-size-with-decorations.html is failing on Catalina.

‎LayoutTests/webaudio/OfflineAudioContext-bad-buffer-crash-expected.txt‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
This test passes if it does not crash.
2+
3+
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
4+
5+
6+
PASS context = new OfflineAudioContext(1, 2**29, 44000) did not throw exception.
7+
PASS context.sampleRate is 44000
8+
PASS new OscillatorNode(context) did not throw exception.
9+
PASS successfullyParsed is true
10+
11+
TEST COMPLETE
12+

‎LayoutTests/webaudio/OfflineAudioContext-bad-buffer-crash.html‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<body>
4+
<script src="../resources/js-test.js"></script>
5+
<script>
6+
description("This test passes if it does not crash.");
7+
8+
shouldNotThrow("context = new OfflineAudioContext(1, 2**29, 44000)");
9+
shouldBe("context.sampleRate", "44000");
10+
shouldNotThrow("new OscillatorNode(context)");
11+
</script>
12+
</body>
13+
</html>

‎Source/WebCore/ChangeLog‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,44 @@
1+
2020-11-05 Chris Dumez <cdumez@apple.com>
2+
3+
Crash in AudioBuffer::sampleRate()
4+
https://bugs.webkit.org/show_bug.cgi?id=218603
5+
6+
Reviewed by Geoffrey Garen.
7+
8+
Have OfflineAudioDestinationNode store the sample rate instead of getting
9+
it from the render buffer. It is possible for an OfflineAudioContext to
10+
have no rendering buffer when constructing this rendering buffer fails
11+
(e.g. because the length is too large).
12+
13+
Test: webaudio/OfflineAudioContext-bad-buffer-crash.html
14+
15+
* Modules/webaudio/AudioContext.cpp:
16+
(WebCore::AudioContext::AudioContext):
17+
* Modules/webaudio/AudioContext.h:
18+
* Modules/webaudio/AudioDestinationNode.cpp:
19+
(WebCore::AudioDestinationNode::AudioDestinationNode):
20+
* Modules/webaudio/AudioDestinationNode.h:
21+
* Modules/webaudio/BaseAudioContext.cpp:
22+
(WebCore::BaseAudioContext::BaseAudioContext):
23+
* Modules/webaudio/BaseAudioContext.h:
24+
* Modules/webaudio/DefaultAudioDestinationNode.cpp:
25+
(WebCore::DefaultAudioDestinationNode::DefaultAudioDestinationNode):
26+
* Modules/webaudio/DefaultAudioDestinationNode.h:
27+
* Modules/webaudio/OfflineAudioContext.cpp:
28+
(WebCore::OfflineAudioContext::OfflineAudioContext):
29+
(WebCore::OfflineAudioContext::create):
30+
* Modules/webaudio/OfflineAudioContext.h:
31+
* Modules/webaudio/OfflineAudioDestinationNode.cpp:
32+
(WebCore::OfflineAudioDestinationNode::OfflineAudioDestinationNode):
33+
* Modules/webaudio/OfflineAudioDestinationNode.h:
34+
* Modules/webaudio/WebKitAudioContext.cpp:
35+
(WebCore::WebKitAudioContext::WebKitAudioContext):
36+
* Modules/webaudio/WebKitAudioContext.h:
37+
* Modules/webaudio/WebKitOfflineAudioContext.cpp:
38+
(WebCore::WebKitOfflineAudioContext::WebKitOfflineAudioContext):
39+
(WebCore::WebKitOfflineAudioContext::create):
40+
* Modules/webaudio/WebKitOfflineAudioContext.h:
41+
142
2020-11-05 Adrian Perez de Castro <aperez@igalia.com>
243

344
[GTK] Add missing const_cast in gdk_event_get_source_device()

‎Source/WebCore/Modules/webaudio/AudioContext.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -120,8 +120,8 @@ AudioContext::AudioContext(Document& document, const AudioContextOptions& contex
120120
}
121121

122122
// Only needed for WebKitOfflineAudioContext.
123-
AudioContext::AudioContext(Document& document, unsigned numberOfChannels, RefPtr<AudioBuffer>&& renderTarget)
124-
: BaseAudioContext(document, numberOfChannels, WTFMove(renderTarget))
123+
AudioContext::AudioContext(Document& document, unsigned numberOfChannels, float sampleRate, RefPtr<AudioBuffer>&& renderTarget)
124+
: BaseAudioContext(document, numberOfChannels, sampleRate, WTFMove(renderTarget))
125125
, m_mediaSession(PlatformMediaSession::create(PlatformMediaSessionManager::sharedManager(), *this))
126126
{
127127
constructCommon();

‎Source/WebCore/Modules/webaudio/AudioContext.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ class AudioContext
8989

9090
protected:
9191
explicit AudioContext(Document&, const AudioContextOptions& = { });
92-
AudioContext(Document&, unsigned numberOfChannels, RefPtr<AudioBuffer>&& renderTarget);
92+
AudioContext(Document&, unsigned numberOfChannels, float sampleRate, RefPtr<AudioBuffer>&& renderTarget);
9393

9494
bool willBeginPlayback();
9595

‎Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,9 @@ namespace WebCore {
4343

4444
WTF_MAKE_ISO_ALLOCATED_IMPL(AudioDestinationNode);
4545

46-
AudioDestinationNode::AudioDestinationNode(BaseAudioContext& context)
46+
AudioDestinationNode::AudioDestinationNode(BaseAudioContext& context, float sampleRate)
4747
: AudioNode(context, NodeTypeDestination)
48+
, m_sampleRate(sampleRate)
4849
{
4950
addInput();
5051
}

‎Source/WebCore/Modules/webaudio/AudioDestinationNode.h‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ namespace WebCore {
3535
class AudioDestinationNode : public AudioNode, public AudioIOCallback {
3636
WTF_MAKE_ISO_ALLOCATED(AudioDestinationNode);
3737
public:
38-
explicit AudioDestinationNode(BaseAudioContext&);
38+
AudioDestinationNode(BaseAudioContext&, float sampleRate);
3939
virtual ~AudioDestinationNode();
4040

4141
// AudioNode
@@ -45,6 +45,8 @@ class AudioDestinationNode : public AudioNode, public AudioIOCallback {
4545
// It will optionally give us local/live audio input in sourceBus (if it's not 0).
4646
void render(AudioBus* sourceBus, AudioBus* destinationBus, size_t numberOfFrames, const AudioIOPosition& outputPosition) override;
4747

48+
float sampleRate() const final { return m_sampleRate; }
49+
4850
size_t currentSampleFrame() const { return m_currentSampleFrame; }
4951
double currentTime() const { return currentSampleFrame() / static_cast<double>(sampleRate()); }
5052

@@ -73,6 +75,7 @@ class AudioDestinationNode : public AudioNode, public AudioIOCallback {
7375
// Counts the number of sample-frames processed by the destination.
7476
std::atomic<size_t> m_currentSampleFrame { 0 };
7577

78+
float m_sampleRate;
7679
bool m_isSilent { true };
7780
bool m_isEffectivelyPlayingAudio { false };
7881
bool m_muted { false };

‎Source/WebCore/Modules/webaudio/BaseAudioContext.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ BaseAudioContext::BaseAudioContext(Document& document, const AudioContextOptions
146146
}
147147

148148
// Constructor for offline (non-realtime) rendering.
149-
BaseAudioContext::BaseAudioContext(Document& document, unsigned numberOfChannels, RefPtr<AudioBuffer>&& renderTarget)
149+
BaseAudioContext::BaseAudioContext(Document& document, unsigned numberOfChannels, float sampleRate, RefPtr<AudioBuffer>&& renderTarget)
150150
: ActiveDOMObject(document)
151151
#if !RELEASE_LOG_DISABLED
152152
, m_logger(document.logger())
@@ -159,7 +159,7 @@ BaseAudioContext::BaseAudioContext(Document& document, unsigned numberOfChannels
159159
FFTFrame::initialize();
160160

161161
// Create a new destination for offline rendering.
162-
m_destinationNode = OfflineAudioDestinationNode::create(*this, numberOfChannels, m_renderTarget.copyRef());
162+
m_destinationNode = OfflineAudioDestinationNode::create(*this, numberOfChannels, sampleRate, m_renderTarget.copyRef());
163163
}
164164

165165
BaseAudioContext::~BaseAudioContext()

‎Source/WebCore/Modules/webaudio/BaseAudioContext.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -293,7 +293,7 @@ class BaseAudioContext
293293

294294
protected:
295295
explicit BaseAudioContext(Document&, const AudioContextOptions& = { });
296-
BaseAudioContext(Document&, unsigned numberOfChannels, RefPtr<AudioBuffer>&& renderTarget);
296+
BaseAudioContext(Document&, unsigned numberOfChannels, float sampleRate, RefPtr<AudioBuffer>&& renderTarget);
297297

298298
void clearPendingActivity();
299299
void makePendingActivity();

0 commit comments

Comments
 (0)