Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bf7ca923e061f649fde26415651ebd2409729f5f
https://github.com/WebKit/WebKit/commit/bf7ca923e061f649fde26415651ebd2409729f5f
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-26 (Sun, 26 Jul 2026)
Changed paths:
M Source/WebCore/Modules/webaudio/OfflineAudioContext.cpp
M Tools/TestWebKitAPI/Resources/cocoa/audio-fingerprinting.js
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/AdvancedPrivacyProtections.mm
Log Message:
-----------
OfflineAudioContext noise injection hangs on feedback cycles in the audio
graph
https://bugs.webkit.org/show_bug.cgi?id=320276
rdar://183194302
Reviewed by Chris Dumez.
OfflineAudioContext::increaseNoiseMultiplierIfNeeded() sets up noise injection
by walking the node graph with a worklist seeded from referencedSourceNodes(),
following each node's outputs via AudioNodeOutput::forEachInputNode(). The walk
kept no record of visited nodes, so it appended every reached node to the
worklist unconditionally.
Web Audio permits cyclic (feedback) graphs, which are legal as long as a
DelayNode breaks the loop. On such a graph the walk never terminates: it keeps
re-appending the nodes in the cycle to the worklist, growing it without bound.
Because this runs under graphLock(), the result is a hung main thread and
runaway memory growth. Non-tree (diamond) topologies were also visited multiple
times, double-counting a node's noise-injection multiplier.
Track visited nodes in a HashSet and only enqueue a node the first time it is
reached. This guarantees termination on cyclic graphs and ensures each node
contributes its noise multiplier exactly once. Linear/tree graphs -- every
realistic audio-fingerprinting probe -- are unaffected.
* Source/WebCore/Modules/webaudio/OfflineAudioContext.cpp:
(WebCore::OfflineAudioContext::increaseNoiseMultiplierIfNeeded): Track visited
nodes so the graph walk neither loops forever on feedback cycles nor
double-counts a node reachable via multiple paths.
* Tools/TestWebKitAPI/Resources/cocoa/audio-fingerprinting.js:
(testFeedbackCycle): Added. Renders an OfflineAudioContext containing a
gain -> delay -> gain feedback cycle and returns the rendered length.
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/AdvancedPrivacyProtections.mm:
(TEST(AdvancedPrivacyProtections, WebAudioNoiseInjectionWithFeedbackCycle)):
Added. With advanced privacy protections enabled (so noise injection runs),
verifies the cyclic graph renders to completion instead of hanging.
Canonical link: https://commits.webkit.org/317950@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
