Closed Bug 1413319 Opened 2 years ago Closed 7 months ago

Assertion failure: aActiveTime >= 0 (Expecting non-negative active time) [@ nsSMILTimedElement::ActiveTimeToSimpleTime]

Categories

(Core :: SVG, defect, P3)

58 Branch
defect

Tracking

()

RESOLVED FIXED
mozilla67
Tracking Status
firefox-esr52 --- wontfix
firefox-esr60 --- wontfix
firefox56 --- wontfix
firefox57 --- wontfix
firefox58 --- wontfix
firefox59 --- wontfix
firefox66 --- wontfix
firefox67 --- fixed

People

(Reporter: tsmith, Assigned: violet.bugreport)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase)

Attachments

(2 files)

Attached file test_case.html
Assertion failure: aActiveTime >= 0 (Expecting non-negative active time), at /src/dom/smil/nsSMILTimedElement.cpp:1988

#0 nsSMILTimedElement::ActiveTimeToSimpleTime(long, unsigned int&) /src/dom/smil/nsSMILTimedElement.cpp:1986:3
#1 nsSMILTimedElement::SampleFillValue() /src/dom/smil/nsSMILTimedElement.cpp:2204:5
#2 nsSMILTimedElement::DoSampleAt(long, bool) /src/dom/smil/nsSMILTimedElement.cpp:691:11
#3 nsSMILAnimationController::DoMilestoneSamples() /src/dom/smil/nsSMILAnimationController.cpp:581:30
#4 nsSMILAnimationController::DoSample(bool) /src/dom/smil/nsSMILAnimationController.cpp:342:3
#5 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /src/layout/base/PresShell.cpp:4176:46
#6 mozilla::PresShell::DoFlushPendingNotifications(mozilla::FlushType) /src/layout/base/PresShell.cpp:4058:3
#7 nsDocument::FlushPendingNotifications(mozilla::FlushType, mozilla::FlushTarget) /src/dom/base/nsDocument.cpp:8545:14
#8 nsDocLoader::DocLoaderIsEmpty(bool) /src/uriloader/base/nsDocLoader.cpp:703:14
#9 nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /src/uriloader/base/nsDocLoader.cpp:632:5
#10 non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /src/uriloader/base/nsDocLoader.cpp:488:14
#11 mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /src/netwerk/base/nsLoadGroup.cpp:629:28
#12 nsDocument::DoUnblockOnload() /src/dom/base/nsDocument.cpp:9374:18
#13 nsDocument::UnblockOnload(bool) /src/dom/base/nsDocument.cpp:9296:9
#14 nsDocument::DispatchContentLoadedEvents() /src/dom/base/nsDocument.cpp:5688:3
#15 mozilla::detail::RunnableMethodImpl<nsDocument*, void (nsDocument::*)(), true, (mozilla::RunnableKind)0>::Run() /src/obj-firefox/dist/include/nsThreadUtils.h:1192:13
#16 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1037:14
#17 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:513:10
#18 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#19 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#20 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#21 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27
#22 nsAppStartup::Run() /src/toolkit/components/startup/nsAppStartup.cpp:288:30
#23 XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4686:22
#24 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4848:8
#25 XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4943:21
#26 do_main(int, char**, char**) /src/browser/app/nsBrowserApp.cpp:231:22
#27 main /src/browser/app/nsBrowserApp.cpp:304:16
#28 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#29 _start (firefox+0x41ebe4)
Flags: in-testsuite?
Goes back more than a year, which is as far back as mozregression can bisect debug builds.
Has Regression Range: --- → no
Priority: -- → P3
Assignee: nobody → violet.bugreport

When close to int64_t's limit, the int64 can't be precisely converted to
double because of rounding error, rounding-up is also allowed. To ensure
a double d is within int64's limit, we should check
d < std::numeric_limits<int64_t>::max(), instead of <=.
Because std::numeric_limits<int64_t>::max() might be converted to a larger
double, when they are equal, we can't be sure if the original one is indeed
within int64's limit.

Keywords: checkin-needed

Pushed by nerli@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a9a91a32262e
Correctly check a double is within long's limit r=birtles

Keywords: checkin-needed
Status: NEW → RESOLVED
Closed: 7 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.