Changeset 199116 in webkit

Timestamp:

Apr 6, 2016 2:21:47 PM (8 years ago)

Author:

jer.noble@apple.com

Message:

CRASH in AudioDestinationNode::render()
​https://bugs.webkit.org/show_bug.cgi?id=156308
<rdar://problem/25468815>

Reviewed by Eric Carlson.

AudioDestinationNode::render() will crash when passed in a zero-length frame count. Rather than get into
this bad state, ASSERT() and bail out early in this case.

Also, address the situation in AudioDestinationIOS::render which can cause this 0-frame count to occur.

• Modules/webaudio/AudioDestinationNode.cpp:

(WebCore::AudioDestinationNode::render):

• platform/audio/ios/AudioDestinationIOS.cpp:

(WebCore::AudioDestinationIOS::render):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/webaudio/AudioDestinationNode.cpp (modified) (1 diff)
• platform/audio/ios/AudioDestinationIOS.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-04-06  Jer Noble  <jer.noble@apple.com>
+
+        CRASH in AudioDestinationNode::render()
+        https://bugs.webkit.org/show_bug.cgi?id=156308
+        <rdar://problem/25468815>
+
+        Reviewed by Eric Carlson.
+
+        
+        AudioDestinationNode::render() will crash when passed in a zero-length frame count. Rather than get into
+        this bad state, ASSERT() and bail out early in this case.
+
+        Also, address the situation in AudioDestinationIOS::render which can cause this 0-frame count to occur.
+
+        * Modules/webaudio/AudioDestinationNode.cpp:
+        (WebCore::AudioDestinationNode::render):
+        * platform/audio/ios/AudioDestinationIOS.cpp:
+        (WebCore::AudioDestinationIOS::render):
+
 2016-04-06  Per Arne Vollan  <peavo@outlook.com>
 

trunk/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp

@@ -69 +69 @@
     }
 
+    ASSERT(numberOfFrames);
+    if (!numberOfFrames) {
+        destinationBus->zero();
+        setIsSilent(true);
+        return;
+    }
+
     // Let the context take care of any business at the start of each render quantum.
     context().handlePreRenderTasks();

trunk/Source/WebCore/platform/audio/ios/AudioDestinationIOS.cpp

@@ -233 +233 @@
         assignAudioBuffersToBus(buffers, *m_renderBus, numberOfBuffers, numberOfFrames, frameOffset, framesThisTime);
 
+        if (!framesThisTime)
+            break;
         if (framesThisTime < kRenderBufferSize) {
             m_callback.render(0, m_spareBus.get(), kRenderBufferSize);