Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1a7d999224fc00ad856f44e592bef7dab0cb726d
https://github.com/WebKit/WebKit/commit/1a7d999224fc00ad856f44e592bef7dab0cb726d
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-26 (Sun, 26 Jul 2026)
Changed paths:
M Source/WebCore/Modules/webaudio/BaseAudioContext.cpp
Log Message:
-----------
std::log2(AudioSession::bufferSize()) invokes undefined behavior when the
session buffer size is 0
https://bugs.webkit.org/show_bug.cgi?id=320275
rdar://183193218
Reviewed by Chris Dumez.
BaseAudioContext::createScriptProcessor(0, ...) picks a buffer size based on
the current AudioSession's buffer size:
bufferSize = 1 << std::max<size_t>(8, std::min<size_t>(14,
std::log2(AudioSession::singleton().bufferSize())));
On Cocoa platforms AudioSession::bufferSize() can legitimately return 0 through
ordinary paths: AudioSessionMac::bufferSize() returns m_bufferSize.value_or(0)
when the CoreAudio device property query fails (e.g. no default output device),
and AudioSessionIOS::bufferSize() computes IOBufferDuration * sampleRate(),
which is 0 before the audio session route is configured.
Per [1]:
"If the argument is ±0, -∞ is returned and FE_DIVBYZERO is raised."
Passing that -infinity to std::min<size_t> forces a float-to-size_t conversion
of an out-of-range value, which is undefined behavior.
Guard the zero case so std::log2 is never called with 0. When the session
buffer size is 0, the exponent falls through to the std::max<size_t>(8, ...)
floor, yielding 256 (2^8) — matching the spec's requirement that the chosen
value be a power of 2 between 256 and 16384. Behavior for all non-zero inputs
is unchanged.
[1] https://en.cppreference.com/cpp/numeric/math/log2
* Source/WebCore/Modules/webaudio/BaseAudioContext.cpp:
(WebCore::BaseAudioContext::createScriptProcessor):
Canonical link: https://commits.webkit.org/317949@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
