1297880 - articles on businessinsider crash with fatal assertion !IsNaN(aValue), at dom/media/TimeUnits.h:91

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P3)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Steps to reproduce:
load http://www.businessinsider.com/apple-taxes-us-treasury-european-commission-2016-8
in a debug build

Actual results:

Crash with:

Assertion failure: !IsNaN(aValue), at /home/dbaron/builds/ssd/mozilla-central/mozilla/dom/media/TimeUnits.h:91 in FromSeconds

My build is a few days old, but debug builds have become unusable enough lately that I no longer have time to test things like updating to current builds when filing the myriad fatal assertions I hit when browsing the Web.





#5  0x00007fe2fee7c3d0 in <signal handler called> ()
    at /lib/x86_64-linux-gnu/libpthread.so.0
#6  0x00007fe2fadaae2d in mozilla::media::TimeUnit::FromSeconds(double) (aValue=nan(0x8000000000000))
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/dom/media/TimeUnits.h:91
#7  0x00007fe2fad8f4e1 in mozilla::MediaDecoder::GetSeekable() (this=0x6592470)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/dom/media/MediaDecoder.cpp:1442
#8  0x00007fe2facc97d0 in mozilla::dom::HTMLMediaElement::Seekable() const (this=<optimized out>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/dom/html/HTMLMediaElement.cpp:1882
#9  0x00007fe2faa6e893 in mozilla::dom::HTMLMediaElementBinding::get_seekable(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLMediaElement*, JSJitGetterCallArgs) (cx=0x24910e0, obj=..., self=<optimized out>, args=...)
    at /home/dbaron/builds/ssd/mozilla-central/obj/firefox-debugopt/dom/bindings/HTMLMediaElementBinding.cpp:818
#10 0x00007fe2faabbb95 in mozilla::dom::GenericBindingGetter(JSContext*, unsigned int, JS::Value*) (cx=cx@entry=0x24910e0, argc=<optimized out>, vp=<optimized out>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/dom/bindings/BindingUtils.cpp:2746
#11 0x00007fe2fc72605f in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) (cx=cx@entry=0x24910e0, native=0x7fe2faabba3a <mozilla::dom::GenericBindingGetter(JSContext*, unsigned int, JS::Value*)>, args=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jscntxtinlines.h:235
#12 0x00007fe2fc71d600 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=cx@entry=0x24910e0, args=..., construct=construct@entry=js::NO_CONSTRUCT)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:453
#13 0x00007fe2fc71d83b in InternalCall(JSContext*, js::AnyInvokeArgs const&) (cx=cx@entry=0x24910e0, args=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:498
#14 0x00007fe2fc71d8bd in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) (cx=cx@entry=0x24910e0, fval=..., fval@entry=..., thisv=..., 
    thisv@entry=..., args=..., rval=..., rval@entry=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:517
#15 0x00007fe2fc71d9d2 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) (cx=0x24910e0, thisv=..., 
    thisv@entry=..., getter=..., getter@entry=..., rval=..., rval@entry=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:631
#16 0x00007fe2fc71dba0 in GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObje---Type <return> to continue, or q <return> to quit---
ct*, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::Shape*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) (vp=..., shape=..., receiver=..., obj=..., cx=0x24910e0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/NativeObject.cpp:1737
#17 0x00007fe2fc71dba0 in GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::Shape*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) (cx=0x24910e0, receiver=..., obj=..., shape=..., vp=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/NativeObject.cpp:1785
#18 0x00007fe2fc71e1f6 in NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<jsid, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) (cx=cx@entry=0x24910e0, obj=..., receiver=..., id=..., nameLookup=nameLookup@entry=NotNameLookup, vp=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/NativeObject.cpp:2012
#19 0x00007fe2fc71e62b in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) (cx=cx@entry=0x24910e0, obj=..., receiver=..., receiver@entry=..., id=..., 
    id@entry=..., vp=..., vp@entry=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/NativeObject.cpp:2046
#20 0x00007fe2fc37a69b in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) (cx=0x24910e0, obj=..., receiver=..., id=..., vp=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/NativeObject.h:1479
#21 0x00007fe2fc73a564 in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) (cx=0x24910e0, obj=obj@entry=..., receiver=receiver@entry=..., name=<optimized out>, vp=..., vp@entry=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jsobj.h:836
#22 0x00007fe2fc71f162 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) (cx=0x24910e0, v=..., name=name@entry=..., vp=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:4169
#23 0x00007fe2fc7153f8 in Interpret(JSContext*, js::RunState&) (vp=..., lval=..., pc=<optimized out>, script=..., fp=0x27b5790, cx=0x24910e0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:189
#24 0x00007fe2fc7153f8 in Interpret(JSContext*, js::RunState&) (cx=cx@entry=0x24910e0, state=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:2598
#25 0x00007fe2fc71d3ed in js::RunScript(JSContext*, js::RunState&) (cx=cx@entry=0x24910e0, state=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:399
#26 0x00007fe2fc71d6ae in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=cx@entry=0x24910e0, args=..., construct=construct@entry=js::NO_CONSTRUCT)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:471
#27 0x00007fe2fc71d83b in InternalCall(JSContext*, js::AnyInvokeArgs const&) (cx=0x24910e0, args=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:498
---Type <return> to continue, or q <return> to quit---
#28 0x00007fe2fc71d88c in js::CallFromStack(JSContext*, JS::CallArgs const&) (cx=<optimized out>, args=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:504
#29 0x00007fe2fc9a3b11 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, uint32_t, JS::Value*, JS::MutableHandleValue) (cx=0x24910e0, frame=0x7ffc7c3d0cd8, stub_=<optimized out>, argc=<optimized out>, vp=0x7ffc7c3d0c68, res=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jit/BaselineIC.cpp:5989
#30 0x00007fe2ff0f7067 in  ()
#31 0x0000000003b70c48 in  ()
#32 0x00007ffc7c3d0c20 in  ()
Python Exception <class 'OverflowError'> int too big to convert: 
#33 0xfff9000000000000 in  ()#34 0x00007fe2fee67560 in js::jit::DoCallFallbackInfo () at /home/dbaron/builds/fraser/firefox-debugopt/libxul.so
#35 0x00007fe2e416a520 in  ()
#36 0x00007fe291fd7b53 in  ()
#37 0x0000000000004822 in  ()
...

Comment 1

[Jean-Yves Avenard [:jya]]

could be a result of bug 1294398?

Comment 2

[Jean-Yves Avenard [:jya]]

Attachment: Bug 1297880: Have GetSeekable return an empty range if duration is not

yet known. r?jwwang

Review commit: https://reviewboard.mozilla.org/r/73982/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/73982/

Comment 3

[JW Wang [:jwwang] [:jw_wang]]

Comment on attachment 8784642 [details]
Bug 1297880: Have GetSeekable return an empty range if duration is not

https://reviewboard.mozilla.org/r/73982/#review71882

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cde62da4f989
Have GetSeekable return an empty range if duration is not r=jwwang

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/cde62da4f989