REGRESSION (Safari 26): AudioData.copyTo() crashes the tab with valid conversion

nipunshukla21 · jyavenard · commit 3fe28c6ca996 · 2025-12-18T22:05:32.000-08:00
https://bugs.webkit.org/show_bug.cgi?id=302521 rdar://164730320 Reviewed by Jean-Yves Avenard. The RELEASE_ASSERT in PlatformRawAudioDataCocoa::copyTo() required (increment - 2) more elements than necessary. This caused crashes when copying planeIndex 2 from 3-channel AudioData. Test: http/wpt/webcodecs/audioData-copyTo-last-channel-does-not-crash.html * LayoutTests/http/wpt/webcodecs/audioData-copyTo-last-channel-does-not-crash-expected.txt: Added. * LayoutTests/http/wpt/webcodecs/audioData-copyTo-last-channel-does-not-crash.html: Added. * Source/WebCore/platform/audio/cocoa/PlatformRawAudioDataCocoa.cpp: (WebCore::PlatformRawAudioData::copyTo): Canonical link: https://commits.webkit.org/304728@main
diff --git a/LayoutTests/http/wpt/webcodecs/audioData-copyTo-last-channel-does-not-crash-expected.txt b/LayoutTests/http/wpt/webcodecs/audioData-copyTo-last-channel-does-not-crash-expected.txt
@@ -0,0 +1,3 @@
+
+PASS Test that copying last channel from interleaved to planar does not crash
+
diff --git a/LayoutTests/http/wpt/webcodecs/audioData-copyTo-last-channel-does-not-crash.html b/LayoutTests/http/wpt/webcodecs/audioData-copyTo-last-channel-does-not-crash.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<header>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+</header>
+<body>
+<script>
+test(() => {
+  const data = new AudioData({
+    numberOfChannels: 3,
+    data: new Float32Array([1, 1, 1]),
+    format: 'f32',
+    numberOfFrames: 1,
+    sampleRate: 48000,
+    timestamp: 0,
+  });
+
+  const dataBytes = new Float32Array(1);
+  data.copyTo(dataBytes, {planeIndex: 2, format: 'f32-planar'});
+
+  data.close();
+}, 'Test that copying last channel from interleaved to planar does not crash');
+</script>
+</body>
+</html>
diff --git a/Source/WebCore/platform/audio/cocoa/PlatformRawAudioDataCocoa.cpp b/Source/WebCore/platform/audio/cocoa/PlatformRawAudioDataCocoa.cpp
@@ -287,7 +287,7 @@ void PlatformRawAudioData::copyTo(std::span<uint8_t> destination, AudioSampleFor
 
     auto copyElements = []<typename T>(std::span<T> destination, auto sourcePlane, size_t sampleOffset, size_t sampleIndexIncrement, size_t samples) {
         RELEASE_ASSERT(destination.size() >= samples);
-        RELEASE_ASSERT(sourcePlane.size() >= sampleIndexIncrement * samples + sampleOffset - 1);
+        RELEASE_ASSERT(sourcePlane.size() > sampleOffset + (samples - 1) * sampleIndexIncrement);
         size_t sourceSampleIndex = sampleOffset;
         for (size_t sample = 0; sample < samples; sample++) {
             destination[sample] = convertAudioSample<T>(sourcePlane[sourceSampleIndex]);

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+`
	`2`	`+PASS Test that copying last channel from interleaved to planar does not crash`
	`3`	`+`