877523 - WebAudio global-buffer-overflow crash [@mozilla::dom::DelayNodeEngine::ProduceAudioBlock]

Status: RESOLVED FIXED

(Core :: Web Audio, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

content/media/webaudio/DelayNode.cpp:215

    // Write the input sample to the correct location in our buffer
    if (input) {
*     buffer[writeIndex] = input[i] * aInput.mVolume;
    }


Tested with http://hg.mozilla.org/integration/mozilla-inbound/rev/c9e6ca6528b8

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 2

[Christoph Diehl [:posidron]]

Attachment: testcase-reduced

Comment 3

[Christoph Diehl [:posidron]]

Tested with http://hg.mozilla.org/integration/mozilla-inbound/rev/d7c6d6061ab5

Comment 4

[(no longer active)]

Attachment: Patch (v1)

OK, this is really embarrassing.  We ended up calculating 0 for all maxDelay values less than 1, so the internal buffer's size would end up being 0.

Comment 5

[(no longer active)]

Attachment: Fixed a typo in the test

Comment 6

[(no longer active)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e12be295c0b1

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e12be295c0b1

Comment 8

[(no longer active)]

Mass moving Web Audio bugs to the Web Audio component.  Filter on duckityduck.

Comment 9

[Lukas Blakk [:lsblakk] use ?needinfo]

No longer tracking for FF23