287477 2025-02-11 04:45:33 -0800 [WebAudio] Ensure AudioBufferSourceNode doesn't read past the input source when not looping 2025-02-12 11:05:24 -0800 1 1 1 Unclassified WebKit Web Audio WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 266396 1 aperez aperez cdumez webkit-bug-importer oldest_to_newest 2093777 0 aperez 2025-02-11 04:45:33 -0800 With C++ library assertions enabled (see bug #266396) we get the following assertion failure: #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 #1 0x0000747a28ca3e83 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78 #2 0x0000747a28c51dce in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #3 0x0000747a28c3983f in __GI_abort () at abort.c:79 #4 0x0000747a28eececd in std::__glibcxx_assert_fail(char const*, int, char const*, char const*) (file=<optimized out>, line=<optimized out>, function=<optimized out>, condition=<optimized out>) at ../../../../../libstdc++-v3/src/c++11/debug.cc:61 #5 0x0000747a3ee6b917 in std::optional<float>::optional<float const&, true>(float const&) (this=0x747a3ee6b917 <std::optional<float>::optional<float const&, true>(float const&)+11>, __t=@0x747658bfc540: 1.68687632e+15) at /usr/include/c++/13.2.0/optional:747 #6 0x0000747a43ae1ac5 in WebCore::AudioBufferSourceNode::renderFromBuffer(WebCore::AudioBus*, unsigned int, unsigned long, double) (this=0x747895004870, bus=0x747a1b296b80, destinationFrameOffset=0, numberOfFrames=128, startFrameOffset=0) at /app/webkit/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:315 #7 0x0000747a43ae0b4c in WebCore::AudioBufferSourceNode::process(unsigned long) (this=0x747895004870, framesToProcess=128) at /app/webkit/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:148 #8 0x0000747a43aeccc4 in WebCore::AudioNode::processIfNecessary(unsigned long) (this=0x747895004870, framesToProcess=128) at /app/webkit/Source/WebCore/Modules/webaudio/AudioNode.cpp:486 #9 0x0000747a43af001e in WebCore::AudioNodeOutput::pull(WebCore::AudioBus*, unsigned long) (this=0x747a1b029980, inPlaceBus=0x0, framesToProcess=128) at /app/webkit/Source/WebCore/Modules/webaudio/AudioNodeOutput.cpp:127 #10 0x0000747a43aef4a1 in WebCore::AudioNodeInput::sumAllConnections(WebCore::AudioBus*, unsigned long) (this=0x747a1b280220, summingBus=0x747a1b2d80c0, framesToProcess=128) at /app/webkit/Source/WebCore/Modules/webaudio/AudioNodeInput.cpp:217 #11 0x0000747a43aef694 in WebCore::AudioNodeInput::pull(WebCore::AudioBus*, unsigned long) (this=0x747a1b280220, inPlaceBus=0x747a1b296a80, framesToProcess=128) at /app/webkit/Source/WebCore/Modules/webaudio/AudioNodeInput.cpp:246 #12 0x0000747a43ae754e in WebCore::AudioDestinationNode::renderQuantum(WebCore::AudioBus*, unsigned long, WebCore::AudioIOPosition const&) (this=0x747895004790, destinationBus=0x747a1b296a80, numberOfFrames=128, outputPosition=...) at /app/webkit/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp:99 #13 0x0000747a43b794c2 in WebCore::DefaultAudioDestinationNode::render(WebCore::AudioBus*, WebCore::AudioBus*, unsigned long, WebCore::AudioIOPosition const&) (this=0x747895004790, destinationBus=0x747a1b296a80, numberOfFrames=128, outputPosition=...) at /app/webkit/Source/WebCore/Modules/webaudio/DefaultAudioDestinationNode.cpp:260 #14 0x0000747a4606b70d in WebCore::AudioDestination::callRenderCallback(WebCore::AudioBus*, WebCore::AudioBus*, unsigned long, WebCore::AudioIOPosition const&) (this=0x747a1b029900, sourceBus=0x0, destinationBus=0x747a1b296a80, framesToProcess=128, outputPosition=...) at /app/webkit/Source/WebCore/platform/audio/AudioDestination.h:107 #15 0x0000747a4610ade1 in webKitWebAudioSrcRenderAndPushFrames(WTF::GRefPtr<_GstElement> const&, WTF::GRefPtr<_GstBuffer>&&) (element=..., buffer=...) at /app/webkit/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:343 #16 0x0000747a4610b2b3 in webKitWebAudioSrcRenderIteration(WebKitWebAudioSrc*) (src=0x63483b50e630) at /app/webkit/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:393 #17 0x0000747a28796a24 in gst_task_func (task=0x63483b5109c0) at ../gst/gsttask.c:399 #18 0x0000747a2934d4f2 in g_thread_pool_thread_proxy (data=<optimized out>) at ../glib/gthreadpool.c:350 #19 0x0000747a2934a862 in g_thread_proxy (data=0x7478e80010b0) at ../glib/gthread.c:831 #20 0x0000747a28ca1e39 in start_thread (arg=<optimized out>) at pthread_create.c:444 #21 0x0000747a28d298c4 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:100 In particular, in frame #6: #6 0x0000747a43ae1ac5 in WebCore::AudioBufferSourceNode::renderFromBuffer (this=0x747895004870, bus=0x747a1b296b80, destinationFrameOffset=0, numberOfFrames=128, startFrameOffset=0) at /app/webkit/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:315 315 destination[writeIndex] = source[readIndex]; (gdb) p readIndex $5 = 8192 (gdb) p source._M_extent $6 = { _M_extent_value = 8192 } The "readIndex" variable is derived from "virtualReadIndex", which is a local copy of "m_virtualReadIndex". When the node is looping over its input ("m_isLooping" is set), the following piece of code ensures that the read cursor is reset to the beginning of the loop position when it goes over the end of the source buffer: // If we're looping and the offset (virtualReadIndex) is past the end of the loop, wrap back to the // beginning of the loop. For other cases, nothing needs to be done. if (m_isLooping && m_virtualReadIndex >= virtualMaxFrame) { m_virtualReadIndex = (m_loopStart < 0) ? 0 : (m_loopStart * m_buffer->sampleRate()); m_virtualReadIndex = std::min(m_virtualReadIndex, static_cast<double>(bufferLength - 1)); } ...but there is no check _when not looping_ to ensure that no reads are done past the end of the source buffer. 2093780 1 aperez 2025-02-11 04:52:55 -0800 Pull request: https://github.com/WebKit/WebKit/pull/40410 2094186 2 ews-feeder 2025-02-12 11:04:04 -0800 Committed 290282@main (c1ad8e16b414): <https://commits.webkit.org/290282@main> Reviewed commits have been landed. Closing PR #40410 and removing active labels. 2094187 3 webkit-bug-importer 2025-02-12 11:05:24 -0800 <rdar://problem/144714026>