Crash Safari with the Web Audio API
Back in the fall of 2016, I was working on adding the equalizer window to Winamp2-js. Unfortuneatly, wireing up the BiquadFilterNodes nessesary to get the correct behavior triggered a bug in Safari, both desktop and mobile, causing Safari to crash hard.
The most interesting part of the crash report was:
Thread 11 Crashed:: com.apple.audio.IOThread.client
0 com.apple.WebCore 0x00007fff9f9dbb35 WTF::CrashOnOverflow::crash() + 5
1 com.apple.WebCore 0x00007fff9f9dbb29 WTF::CrashOnOverflow::overflowed() + 9
2 com.apple.WebCore 0x00007fff9fa84b77 WebCore::BiquadProcessor::process(WebCore::AudioBus const*, WebCore::AudioBus*, unsigned long) + 215
To be clear, I have no idea what exactly that means, but it looks intresting. I reported the bug in their bug tracker and figured I'd wait until I heard back to invest more energy in the feature. As months passed, and it became obvious that this bug was not a priority for the Safari team, I occasionally would revist the bug, trying to either narrow down what was causing it, or find some way to work around it.
Finally, in April of this year, 2017, I figured out that it was related to the order in which the audio nodes were being connected, and was able to come up with a workaround for Winamp2-js.
This also allowed me to create a much more minimal script that triggered the bug, and I thought I would share that today:
<script>
var context = new (window.AudioContext || window.webkitAudioContext)();
function start() {
var source = context.createOscillator();
var chanMerge = context.createChannelMerger(2);
var filter = context.createBiquadFilter();
source.connect(chanMerge, 0, 0);
source.connect(chanMerge, 0, 1);
// Connecting the channel merger directly to
// the biquad filter seems to be the problem.
chanMerge.connect(filter);
filter.connect(context.destination);
source.start(0);
source.stop(2); // This triggers the crash.
}
</script>
<p>Safari will crash on/before the end of the tone</p>
<button onclick="start()">Play then crash</button>
Open this page in Safari, click the button, wait two seconds and watch it crash.