Title: [199116] trunk/Source/WebCore
- Revision
- 199116
- Author
- [email protected]
- Date
- 2016-04-06 14:21:47 -0700 (Wed, 06 Apr 2016)
Log Message
CRASH in AudioDestinationNode::render()
https://bugs.webkit.org/show_bug.cgi?id=156308
<rdar://problem/25468815>
Reviewed by Eric Carlson.
AudioDestinationNode::render() will crash when passed in a zero-length frame count. Rather than get into
this bad state, ASSERT() and bail out early in this case.
Also, address the situation in AudioDestinationIOS::render which can cause this 0-frame count to occur.
* Modules/webaudio/AudioDestinationNode.cpp:
(WebCore::AudioDestinationNode::render):
* platform/audio/ios/AudioDestinationIOS.cpp:
(WebCore::AudioDestinationIOS::render):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (199115 => 199116)
--- trunk/Source/WebCore/ChangeLog 2016-04-06 20:52:11 UTC (rev 199115)
+++ trunk/Source/WebCore/ChangeLog 2016-04-06 21:21:47 UTC (rev 199116)
@@ -1,3 +1,22 @@
+2016-04-06 Jer Noble <[email protected]>
+
+ CRASH in AudioDestinationNode::render()
+ https://bugs.webkit.org/show_bug.cgi?id=156308
+ <rdar://problem/25468815>
+
+ Reviewed by Eric Carlson.
+
+
+ AudioDestinationNode::render() will crash when passed in a zero-length frame count. Rather than get into
+ this bad state, ASSERT() and bail out early in this case.
+
+ Also, address the situation in AudioDestinationIOS::render which can cause this 0-frame count to occur.
+
+ * Modules/webaudio/AudioDestinationNode.cpp:
+ (WebCore::AudioDestinationNode::render):
+ * platform/audio/ios/AudioDestinationIOS.cpp:
+ (WebCore::AudioDestinationIOS::render):
+
2016-04-06 Per Arne Vollan <[email protected]>
[WinCairo][MediaFoundation] Videos are always autoplaying.
Modified: trunk/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp (199115 => 199116)
--- trunk/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp 2016-04-06 20:52:11 UTC (rev 199115)
+++ trunk/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp 2016-04-06 21:21:47 UTC (rev 199116)
@@ -68,6 +68,13 @@
return;
}
+ ASSERT(numberOfFrames);
+ if (!numberOfFrames) {
+ destinationBus->zero();
+ setIsSilent(true);
+ return;
+ }
+
// Let the context take care of any business at the start of each render quantum.
context().handlePreRenderTasks();
Modified: trunk/Source/WebCore/platform/audio/ios/AudioDestinationIOS.cpp (199115 => 199116)
--- trunk/Source/WebCore/platform/audio/ios/AudioDestinationIOS.cpp 2016-04-06 20:52:11 UTC (rev 199115)
+++ trunk/Source/WebCore/platform/audio/ios/AudioDestinationIOS.cpp 2016-04-06 21:21:47 UTC (rev 199116)
@@ -232,6 +232,8 @@
UInt32 framesThisTime = std::min<UInt32>(kRenderBufferSize, framesRemaining);
assignAudioBuffersToBus(buffers, *m_renderBus, numberOfBuffers, numberOfFrames, frameOffset, framesThisTime);
+ if (!framesThisTime)
+ break;
if (framesThisTime < kRenderBufferSize) {
m_callback.render(0, m_spareBus.get(), kRenderBufferSize);
m_renderBus->copyFromRange(*m_spareBus, 0, framesThisTime);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
