[Webkit-unassigned] [Bug 287477] New: [WebAudio] Ensure AudioBufferSourceNode doesn't read past the input source when not looping

Tue Feb 11 04:45:33 PST 2025

https://bugs.webkit.org/show_bug.cgi?id=287477

            Bug ID: 287477
           Summary: [WebAudio] Ensure AudioBufferSourceNode doesn't read
                    past the input source when not looping
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Web Audio
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: aperez at igalia.com
                CC: cdumez at apple.com

With C++ library assertions enabled (see bug #266396) we get the following assertion failure:

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo at entry=6, no_tid=no_tid at entry=0) at pthread_kill.c:44
#1  0x0000747a28ca3e83 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
#2  0x0000747a28c51dce in __GI_raise (sig=sig at entry=6) at ../sysdeps/posix/raise.c:26
#3  0x0000747a28c3983f in __GI_abort () at abort.c:79
#4  0x0000747a28eececd in std::__glibcxx_assert_fail(char const*, int, char const*, char const*) (file=<optimized out>, line=<optimized out>, function=<optimized out>, condition=<optimized out>) at ../../../../../libstdc++-v3/src/c++11/debug.cc:61
#5  0x0000747a3ee6b917 in std::optional<float>::optional<float const&, true>(float const&) (this=0x747a3ee6b917 <std::optional<float>::optional<float const&, true>(float const&)+11>, __t=@0x747658bfc540: 1.68687632e+15)
    at /usr/include/c++/13.2.0/optional:747
#6  0x0000747a43ae1ac5 in WebCore::AudioBufferSourceNode::renderFromBuffer(WebCore::AudioBus*, unsigned int, unsigned long, double) (this=0x747895004870, bus=0x747a1b296b80, destinationFrameOffset=0, numberOfFrames=128, startFrameOffset=0)
    at /app/webkit/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:315
#7  0x0000747a43ae0b4c in WebCore::AudioBufferSourceNode::process(unsigned long) (this=0x747895004870, framesToProcess=128) at /app/webkit/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:148
#8  0x0000747a43aeccc4 in WebCore::AudioNode::processIfNecessary(unsigned long) (this=0x747895004870, framesToProcess=128) at /app/webkit/Source/WebCore/Modules/webaudio/AudioNode.cpp:486
#9  0x0000747a43af001e in WebCore::AudioNodeOutput::pull(WebCore::AudioBus*, unsigned long) (this=0x747a1b029980, inPlaceBus=0x0, framesToProcess=128) at /app/webkit/Source/WebCore/Modules/webaudio/AudioNodeOutput.cpp:127
#10 0x0000747a43aef4a1 in WebCore::AudioNodeInput::sumAllConnections(WebCore::AudioBus*, unsigned long) (this=0x747a1b280220, summingBus=0x747a1b2d80c0, framesToProcess=128) at /app/webkit/Source/WebCore/Modules/webaudio/AudioNodeInput.cpp:217
#11 0x0000747a43aef694 in WebCore::AudioNodeInput::pull(WebCore::AudioBus*, unsigned long) (this=0x747a1b280220, inPlaceBus=0x747a1b296a80, framesToProcess=128) at /app/webkit/Source/WebCore/Modules/webaudio/AudioNodeInput.cpp:246
#12 0x0000747a43ae754e in WebCore::AudioDestinationNode::renderQuantum(WebCore::AudioBus*, unsigned long, WebCore::AudioIOPosition const&) (this=0x747895004790, destinationBus=0x747a1b296a80, numberOfFrames=128, outputPosition=...)
    at /app/webkit/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp:99
#13 0x0000747a43b794c2 in WebCore::DefaultAudioDestinationNode::render(WebCore::AudioBus*, WebCore::AudioBus*, unsigned long, WebCore::AudioIOPosition const&) (this=0x747895004790, destinationBus=0x747a1b296a80, numberOfFrames=128, outputPosition=...)
    at /app/webkit/Source/WebCore/Modules/webaudio/DefaultAudioDestinationNode.cpp:260
#14 0x0000747a4606b70d in WebCore::AudioDestination::callRenderCallback(WebCore::AudioBus*, WebCore::AudioBus*, unsigned long, WebCore::AudioIOPosition const&)
    (this=0x747a1b029900, sourceBus=0x0, destinationBus=0x747a1b296a80, framesToProcess=128, outputPosition=...) at /app/webkit/Source/WebCore/platform/audio/AudioDestination.h:107
#15 0x0000747a4610ade1 in webKitWebAudioSrcRenderAndPushFrames(WTF::GRefPtr<_GstElement> const&, WTF::GRefPtr<_GstBuffer>&&) (element=..., buffer=...) at /app/webkit/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:343
#16 0x0000747a4610b2b3 in webKitWebAudioSrcRenderIteration(WebKitWebAudioSrc*) (src=0x63483b50e630) at /app/webkit/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:393
#17 0x0000747a28796a24 in gst_task_func (task=0x63483b5109c0) at ../gst/gsttask.c:399
#18 0x0000747a2934d4f2 in g_thread_pool_thread_proxy (data=<optimized out>) at ../glib/gthreadpool.c:350
#19 0x0000747a2934a862 in g_thread_proxy (data=0x7478e80010b0) at ../glib/gthread.c:831
#20 0x0000747a28ca1e39 in start_thread (arg=<optimized out>) at pthread_create.c:444
#21 0x0000747a28d298c4 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:100

In particular, in frame #6:

#6  0x0000747a43ae1ac5 in WebCore::AudioBufferSourceNode::renderFromBuffer (this=0x747895004870, bus=0x747a1b296b80, destinationFrameOffset=0, numberOfFrames=128, startFrameOffset=0)
    at /app/webkit/Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:315
315                         destination[writeIndex] = source[readIndex];
(gdb) p readIndex
$5 = 8192
(gdb) p source._M_extent
$6 = {
  _M_extent_value = 8192
}

The "readIndex" variable is derived from "virtualReadIndex", which is a local copy of "m_virtualReadIndex". When the node is looping over its input ("m_isLooping" is set), the following piece of code ensures that the read cursor is reset to the beginning of the loop position when it goes over the end of the source buffer:

    // If we're looping and the offset (virtualReadIndex) is past the end of the loop, wrap back to the
    // beginning of the loop. For other cases, nothing needs to be done.
    if (m_isLooping && m_virtualReadIndex >= virtualMaxFrame) {
        m_virtualReadIndex = (m_loopStart < 0) ? 0 : (m_loopStart * m_buffer->sampleRate());
        m_virtualReadIndex = std::min(m_virtualReadIndex, static_cast<double>(bufferLength - 1));
    }

...but there is no check _when not looping_ to ensure that no reads are done past the end of the source buffer.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20250211/cf1aa476/attachment-0001.htm>