Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2f91fd7d2ec69d1ca85edef694626ee9cebac8f1
https://github.com/WebKit/WebKit/commit/2f91fd7d2ec69d1ca85edef694626ee9cebac8f1
Author: Anthony Tarbinian <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
LayoutTests/webaudio/biquadfilternode-set-type-channel-count-race-expected.txt
A LayoutTests/webaudio/biquadfilternode-set-type-channel-count-race.html
M Source/WebCore/Modules/webaudio/BiquadFilterNode.cpp
Log Message:
-----------
[WebCore] Take graphLock() in BiquadFilterNode::setType() to avoid race
with audio-thread kernel reallocation
rdar://174652790
https://bugs.webkit.org/show_bug.cgi?id=312796
Reviewed by Chris Dumez.
BiquadFilterNode::setType() runs on the main thread from JS bindings and calls
BiquadProcessor::setType(), which in turn calls AudioDSPKernelProcessor::reset()
to iterate m_kernels and virtual-call reset() on each kernel. This was done
without holding the context's graphLock().
Concurrently, every render quantum the audio thread runs
AudioBasicProcessorNode::checkNumberOfChannelsForInput() under graphLock() and,
when the input channel count has changed, calls uninitialize() / initialize()
on the processor, which clear()s and move-assigns m_kernels.
With the lock held only on one side, the main thread could load a kernel pointer
from a Vector slot that is being/already freed, leading to a use-after-free
virtual
dispatch into a destroyed BiquadDSPKernel and writes through stale Biquad
buffer spans, or a null deref if the slot was already zeroed.
Fix by taking context().graphLock() in BiquadFilterNode::setType(), matching the
existing convention in WaveShaperNode::setOversampleForBindings() and
AudioNode::setChannelCount().
Test: webaudio/biquadfilternode-set-type-channel-count-race.html
*
LayoutTests/webaudio/biquadfilternode-set-type-channel-count-race-expected.txt:
Added.
* LayoutTests/webaudio/biquadfilternode-set-type-channel-count-race.html: Added.
* Source/WebCore/Modules/webaudio/BiquadFilterNode.cpp:
(WebCore::BiquadFilterNode::setType):
Originally-landed-as: 305413.717@safari-7624-branch (41efaeddddf2).
rdar://180436998
Canonical link: https://commits.webkit.org/316175@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
