Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4f825db16c72d8d4e064164b868741ba443920d5
https://github.com/WebKit/WebKit/commit/4f825db16c72d8d4e064164b868741ba443920d5
Author: Chris Dumez <[email protected]>
Date: 2026-08-04 (Tue, 04 Aug 2026)
Changed paths:
M Source/WebCore/platform/audio/Biquad.cpp
M Source/WebCore/platform/audio/Biquad.h
M Source/WebCore/platform/audio/DirectConvolver.cpp
M Source/WebCore/platform/audio/VectorMath.cpp
M Source/WebCore/platform/audio/VectorMath.h
Log Message:
-----------
Harden Biquad and DirectConvolver by routing Accelerate DSP calls through
span-based VectorMath helpers
https://bugs.webkit.org/show_bug.cgi?id=320728
Reviewed by Darin Adler.
Biquad::processSliceFast and DirectConvolver::process called vDSP_deq22D and
vDSP_conv directly, passing raw pointers (.data()) and element counts. These raw
pointer accesses are not covered by hardened libc++, so an incorrect length or
buffer size would read/write out of bounds in release builds; the only guards
were the surrounding invariants and debug-only assertions.
Move both calls into new VectorMath helpers that take std::span and
RELEASE_ASSERT
the sizes the underlying vDSP routine actually accesses, matching the existing
convention in this file:
- filterBiquad() wraps vDSP_deq22D and asserts that source and destination
each
hold at least framesToProcess + 2 elements (the two filter history samples
deq22
reads/writes). The coefficients are taken as std::span<const double, 5> so
that
the 5-element requirement is enforced at compile time rather than by a
RELEASE_ASSERT; the fixed extent is threaded through
Biquad::processSliceFast,
whose caller already holds a std::array<double, 5>. filterBiquad() is
Accelerate-only, since the non-Accelerate Biquad path uses a scalar
direct-form
recurrence and never builds the deq22 buffer layout.
- convolve() wraps vDSP_conv and asserts a non-empty filter and that the
signal
holds at least output.size() + filter.size() - 1 elements. The
non-Accelerate
CONVOLVE_ONE_SAMPLE reference implementation is moved out of
DirectConvolver into
convolve()'s #else branch, so all ports share one bounds-checked
implementation
and DirectConvolver::process becomes a thin caller.
Also drop the now-unused <Accelerate/Accelerate.h> includes (and Biquad's
__VFORCE_H
workaround) from both files.
* Source/WebCore/platform/audio/Biquad.cpp:
(WebCore::Biquad::processFast):
(WebCore::Biquad::processSliceFast):
* Source/WebCore/platform/audio/Biquad.h:
* Source/WebCore/platform/audio/DirectConvolver.cpp:
(WebCore::DirectConvolver::process):
* Source/WebCore/platform/audio/VectorMath.cpp:
(WebCore::VectorMath::filterBiquad):
(WebCore::VectorMath::convolve):
* Source/WebCore/platform/audio/VectorMath.h:
Canonical link: https://commits.webkit.org/318530@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
