Bug 287431

In 288121@main (bug #284897) the convolution code was changed from using a "float*" to a "std::span<float>". The code previously used a float* pointing to the *middle* of a buffer, which was defined as: float* inputP = m_buffer.data() + m_inputBlockSize; and then changed to: auto inputP = m_buffer.span().subspan(m_inputBlockSize); In both cases above "inputP" points to the middle of "m_buffer", because this is always initialized to have double the amount of elements of "m_inputBlockSize": DirectConvolver::DirectConvolver(size_t inputBlockSize) : m_inputBlockSize(inputBlockSize) , m_buffer(inputBlockSize * 2) { } Later, there is a loop which is roughly this, plus unrolled cases for a few kernel sizes, but the issue is the same in all of them: #define CONVOLVE_ONE_SAMPLE \ sum += inputP[i - j] * kernelP[j]; \ j++; size_t i = 0; while (i < source.size()) { size_t j = 0; float sum = 0; while (j < kernelSize) { CONVOLVE_ONE_SAMPLE } destination[i++] = sum; } Inside the macro, the calculated "i - j" index *will be negative* most of the time, to pick elements from the *left* half of "m_buffer". While this worked fine with the raw "float*", indexing a "std::span<float>" will coerce the negative index into a "size_t" with the values wrapping around (due to underflow) and resulting into huge indexes. This triggers an assertion when the C++ library assertions are enabled (for example with the patch for bug #266396).