1f9ec27bbe7f6e3fc8e07ce456f6b83945753417  [WebAudio] Use TryAllocate in AudioWorklet output buffer allocation

The bug at a glance

Pre-patch, AudioBus::Create for unconnected AudioWorklet outputs could abort/crash the renderer on allocation failure under memory pressure; the fix switches to TryCreate and reports a render error instead, plus adds a null-bus guard in the processor. This is a renderer-local reliability/DoS hardening with no memory-corruption primitive.

A page can provoke large per-output buffer allocations in an AudioWorklet to crash the renderer under low-memory conditions; the fix degrades gracefully instead of aborting, and the processor guard prevents dereferencing a now-possible null output bus.

Root cause

In AudioWorkletHandler::Process, unconnected outputs were allocated with AudioBus::Create, which crashes (CHECK/OOM abort) if allocation fails. The patch uses AudioBus::TryCreate, and on failure sets allocation_failed, breaks, posts an AudioWorkletProcessorErrorDetails(kProcessError) to the main thread, finishes the processor, and returns—so OOM becomes a reported render error rather than a crash. Because an output bus can now be null (skipped), audio_worklet_processor.cc adds an if (!audio_bus) continue; guard to avoid dereferencing a null AudioBus when copying channels.

Key code

Fallible TryCreate replaces crash-on-OOM Create

-            AudioBus::Create(Output(i).Bus()->NumberOfChannels(),
-                             GetDeferredTaskHandler().RenderQuantumFrames());
+            AudioBus::TryCreate(Output(i).Bus()->NumberOfChannels(),
+                                GetDeferredTaskHandler().RenderQuantumFrames());
+        if (!unconnected_outputs_[i]) {
+          allocation_failed = true;
+          break;
+        }

Patch walkthrough

• third_party/blink/renderer/modules/webaudio/audio_worklet_handler.cc — Replaces crash-prone AudioBus::Create with TryCreate for unconnected output buffers and, on allocation failure, posts a processor error and aborts the render quantum cleanly instead of aborting the process.
• third_party/blink/renderer/modules/webaudio/audio_worklet_processor.cc — Adds a null-check that skips a null output AudioBus, preventing a null-pointer dereference now that outputs can be absent after an allocation failure.

Background

AudioWorklet — Web Audio feature running author-supplied JS processors on the real-time audio render thread.

AudioBus::Create vs TryCreate — Create aborts on allocation failure while TryCreate returns null, allowing callers to handle OOM gracefully.

Render quantum — The block of frames processed per audio callback; larger quanta and channel counts increase per-output buffer size.

Vulnerability window

1. Reachability — Ordinary web content in a stock build: a page creates an AudioWorklet node with unconnected outputs and large channel counts/render quantum.
2. Trigger — Under memory pressure the unconnected-output AudioBus allocation fails on the render thread.
3. Primitive — Pre-patch this aborts the renderer process (DoS); post-patch it is reported as a processor render error (inferred crash behavior of Create on OOM).
4. Escalation — No memory-corruption escalation; impact is limited to renderer crash/denial of service.

Proof of concept

Conceptually, drive the renderer toward memory exhaustion while instantiating an AudioWorklet node whose outputs are unconnected and sized with many channels/large render quantum, so the per-output buffer allocation fails during Process; pre-patch this crashes the renderer. No exploit code provided.

Exploitation

1. Pressure — Page allocates memory to approach exhaustion (inferred).
2. Trigger — AudioWorklet unconnected-output allocation fails during render, causing a crash pre-patch (inferred).

Detection & hunting

For defenders and detection engineers:

• grep for AudioBus::Create( on real-time/render-thread paths and compare against TryCreate adoption — Find remaining infallible allocations on audio render paths that can abort on OOM and should handle failure.
• weggli for pointer uses of an AudioBus/output without a preceding null check after TryCreate — Hunt for consumers that assume a non-null bus where allocation can now fail.

Audit directions

• Other Web Audio handlers/processors allocating buffers per render quantum — Audit for infallible Create calls on the audio thread and for consumers lacking null-bus guards after any switch to TryCreate.