<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[205744] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/205744">205744</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2016-09-09 09:17:19 -0700 (Fri, 09 Sep 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Regression(<a href="http://trac.webkit.org/projects/webkit/changeset/186020">r186020</a>): Null dereference in getStartDate()
https://bugs.webkit.org/show_bug.cgi?id=161733

Reviewed by Eric Carlson.

Source/WebCore:

Update HTMLMediaElement::getStartDate() to return NaN if m_player is null,
instead of crashing.

Test: fast/media/getStartDate-NaN.html

* bindings/js/IDBBindingUtilities.cpp:
(WebCore::toJS):
Add a FIXME comment as this code is using jsDateOrNull() but should
probably be using jsDate() as per:
- http://w3c.github.io/IndexedDB/#request-convert-a-key-to-a-value

* bindings/js/JSDOMBinding.cpp:
(WebCore::jsDate):
(WebCore::jsDateOrNull):
* bindings/js/JSDOMBinding.h:
- Rename jsDateOrNaN() to jsDate() as this is the default behavior. Also,
  return new Date(NaN) instead of NaN if the implementation returns NaN.
  The IDL says we should return a Date, not a number.
- Update jsDateOrNull() to only return jsNull() if the native value is
  NaN, instead of doing so for every value that is not finite. Our
  convention is to use NaN as special value to represent null in JS.

* bindings/scripts/CodeGeneratorJS.pm:
(NativeToJSValue):
When converting a native value (double) into a Date, rely on the fact
that the type is nullable when deciding if we should call jsDate() or
jsDateOrNull() to convert. This way, we no longe need a WebKit specific
[TreatReturnedDateAs=Null|NaN] IDL extended attribute.

* bindings/scripts/IDLAttributes.txt:
* html/HTMLInputElement.idl:
Mark valueAsDate attribute as nullable, as per the specification:
- https://html.spec.whatwg.org/#htmlinputelement

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::getStartDate):
Return NaN if m_player is null instead of crashing. The reason I decided
to return NaN is because the specification [1] says to return a new Date
object representing the current timeline offset. The spec of timeline
offset [2] says that the initial timeline offset value is NaN.
[1] https://html.spec.whatwg.org/#dom-media-getstartdate
[2] https://html.spec.whatwg.org/#timeline-offset

* bindings/scripts/IDLAttributes.txt:
* html/HTMLMediaElement.idl:
Drop [TreatReturnedDateAs] attribute as it is no longer supported.

LayoutTests:

Add layout test coverage.

* fast/media/getStartDate-NaN-expected.txt: Added.
* fast/media/getStartDate-NaN.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsIDBBindingUtilitiescpp">trunk/Source/WebCore/bindings/js/IDBBindingUtilities.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMBindingcpp">trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMBindingh">trunk/Source/WebCore/bindings/js/JSDOMBinding.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsIDLAttributestxt">trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLInputElementidl">trunk/Source/WebCore/html/HTMLInputElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMediaElementcpp">trunk/Source/WebCore/html/HTMLMediaElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMediaElementidl">trunk/Source/WebCore/html/HTMLMediaElement.idl</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastmediagetStartDateNaNexpectedtxt">trunk/LayoutTests/fast/media/getStartDate-NaN-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastmediagetStartDateNaNhtml">trunk/LayoutTests/fast/media/getStartDate-NaN.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (205743 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2016-09-09 15:42:13 UTC (rev 205743)
+++ trunk/LayoutTests/ChangeLog        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2016-09-09  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Regression(r186020): Null dereference in getStartDate()
+        https://bugs.webkit.org/show_bug.cgi?id=161733
+
+        Reviewed by Eric Carlson.
+
+        Add layout test coverage.
+
+        * fast/media/getStartDate-NaN-expected.txt: Added.
+        * fast/media/getStartDate-NaN.html: Added.
+
</ins><span class="cx"> 2016-09-09  Youenn Fablet  &lt;youenn@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Sync web-platform-tests up to revision 6d9c836
</span></span></pre></div>
<a id="trunkLayoutTestsfastmediagetStartDateNaNexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/media/getStartDate-NaN-expected.txt (0 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/media/getStartDate-NaN-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/media/getStartDate-NaN-expected.txt        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+Tests that calling media.getStartDate() returns NaN when no start date is available.
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS isNaN(document.createElement('audio').getStartDate()) is true
+PASS isNaN(document.createElement('video').getStartDate()) is true
+PASS document.createElement('audio').getStartDate() is an instance of Date
+PASS document.createElement('video').getStartDate() is an instance of Date
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastmediagetStartDateNaNhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/media/getStartDate-NaN.html (0 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/media/getStartDate-NaN.html                                (rev 0)
+++ trunk/LayoutTests/fast/media/getStartDate-NaN.html        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -0,0 +1,15 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script&gt;
+description(&quot;Tests that calling media.getStartDate() returns NaN when no start date is available.&quot;);
+
+shouldBeTrue(&quot;isNaN(document.createElement('audio').getStartDate())&quot;);
+shouldBeTrue(&quot;isNaN(document.createElement('video').getStartDate())&quot;);
+shouldBeType(&quot;document.createElement('audio').getStartDate()&quot;, &quot;Date&quot;);
+shouldBeType(&quot;document.createElement('video').getStartDate()&quot;, &quot;Date&quot;);
+&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (205743 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-09-09 15:42:13 UTC (rev 205743)
+++ trunk/Source/WebCore/ChangeLog        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -1,3 +1,57 @@
</span><ins>+2016-09-09  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Regression(r186020): Null dereference in getStartDate()
+        https://bugs.webkit.org/show_bug.cgi?id=161733
+
+        Reviewed by Eric Carlson.
+
+        Update HTMLMediaElement::getStartDate() to return NaN if m_player is null,
+        instead of crashing.
+
+        Test: fast/media/getStartDate-NaN.html
+
+        * bindings/js/IDBBindingUtilities.cpp:
+        (WebCore::toJS):
+        Add a FIXME comment as this code is using jsDateOrNull() but should
+        probably be using jsDate() as per:
+        - http://w3c.github.io/IndexedDB/#request-convert-a-key-to-a-value
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsDate):
+        (WebCore::jsDateOrNull):
+        * bindings/js/JSDOMBinding.h:
+        - Rename jsDateOrNaN() to jsDate() as this is the default behavior. Also,
+          return new Date(NaN) instead of NaN if the implementation returns NaN.
+          The IDL says we should return a Date, not a number.
+        - Update jsDateOrNull() to only return jsNull() if the native value is
+          NaN, instead of doing so for every value that is not finite. Our
+          convention is to use NaN as special value to represent null in JS.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (NativeToJSValue):
+        When converting a native value (double) into a Date, rely on the fact
+        that the type is nullable when deciding if we should call jsDate() or
+        jsDateOrNull() to convert. This way, we no longe need a WebKit specific
+        [TreatReturnedDateAs=Null|NaN] IDL extended attribute.
+
+        * bindings/scripts/IDLAttributes.txt:
+        * html/HTMLInputElement.idl:
+        Mark valueAsDate attribute as nullable, as per the specification:
+        - https://html.spec.whatwg.org/#htmlinputelement
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::getStartDate):
+        Return NaN if m_player is null instead of crashing. The reason I decided
+        to return NaN is because the specification [1] says to return a new Date
+        object representing the current timeline offset. The spec of timeline
+        offset [2] says that the initial timeline offset value is NaN.
+        [1] https://html.spec.whatwg.org/#dom-media-getstartdate
+        [2] https://html.spec.whatwg.org/#timeline-offset
+
+        * bindings/scripts/IDLAttributes.txt:
+        * html/HTMLMediaElement.idl:
+        Drop [TreatReturnedDateAs] attribute as it is no longer supported.
+
</ins><span class="cx"> 2016-09-09  Youenn Fablet  &lt;youenn@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         ASSERTION FAILED: promise.inherits(JSPromise::info())
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsIDBBindingUtilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/IDBBindingUtilities.cpp (205743 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/IDBBindingUtilities.cpp        2016-09-09 15:42:13 UTC (rev 205743)
+++ trunk/Source/WebCore/bindings/js/IDBBindingUtilities.cpp        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -106,6 +106,8 @@
</span><span class="cx">     case KeyType::String:
</span><span class="cx">         return jsStringWithCache(&amp;state, key-&gt;string());
</span><span class="cx">     case KeyType::Date:
</span><ins>+        // FIXME: This should probably be jsDate() as per:
+        // http://w3c.github.io/IndexedDB/#request-convert-a-key-to-a-value
</ins><span class="cx">         return jsDateOrNull(&amp;state, key-&gt;date());
</span><span class="cx">     case KeyType::Number:
</span><span class="cx">         return jsNumber(key-&gt;number());
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMBindingcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp (205743 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp        2016-09-09 15:42:13 UTC (rev 205743)
+++ trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -165,16 +165,15 @@
</span><span class="cx">     return value.isUndefinedOrNull() ? String() : valueToUSVString(exec, value);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSValue jsDateOrNaN(ExecState* exec, double value)
</del><ins>+JSValue jsDate(ExecState* exec, double value)
</ins><span class="cx"> {
</span><del>-    if (std::isnan(value))
-        return jsDoubleNumber(value);
-    return jsDateOrNull(exec, value);
</del><ins>+    return DateInstance::create(exec-&gt;vm(), exec-&gt;lexicalGlobalObject()-&gt;dateStructure(), value);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSValue jsDateOrNull(ExecState* exec, double value)
</span><span class="cx"> {
</span><del>-    if (!std::isfinite(value))
</del><ins>+    // For nullable Date types, we use NaN as null value.
+    if (std::isnan(value))
</ins><span class="cx">         return jsNull();
</span><span class="cx">     return DateInstance::create(exec-&gt;vm(), exec-&gt;lexicalGlobalObject()-&gt;dateStructure(), value);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMBindingh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMBinding.h (205743 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMBinding.h        2016-09-09 15:42:13 UTC (rev 205743)
+++ trunk/Source/WebCore/bindings/js/JSDOMBinding.h        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -249,12 +249,9 @@
</span><span class="cx"> WEBCORE_EXPORT int64_t toInt64(JSC::ExecState&amp;, JSC::JSValue);
</span><span class="cx"> WEBCORE_EXPORT uint64_t toUInt64(JSC::ExecState&amp;, JSC::JSValue);
</span><span class="cx"> 
</span><del>-// Returns a Date instance for the specified value, or NaN if the date is not a number.
-JSC::JSValue jsDateOrNaN(JSC::ExecState*, double);
</del><ins>+JSC::JSValue jsDate(JSC::ExecState*, double value);
+JSC::JSValue jsDateOrNull(JSC::ExecState*, double value);
</ins><span class="cx"> 
</span><del>-// Returns a Date instance for the specified value, or null if the value is NaN or infinity.
-JSC::JSValue jsDateOrNull(JSC::ExecState*, double);
-
</del><span class="cx"> // NaN if the value can't be converted to a date.
</span><span class="cx"> double valueToDate(JSC::ExecState*, JSC::JSValue);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (205743 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-09-09 15:42:13 UTC (rev 205743)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -4802,10 +4802,8 @@
</span><span class="cx">     return &quot;jsBoolean($value)&quot; if $type eq &quot;boolean&quot;;
</span><span class="cx"> 
</span><span class="cx">     if ($type eq &quot;Date&quot;) {
</span><del>-        my $handlingForNaN = $signature-&gt;extendedAttributes-&gt;{&quot;TreatReturnedNaNDateAs&quot;};
-        return &quot;jsDateOrNull(state, $value)&quot; if !defined $handlingForNaN || $handlingForNaN eq &quot;Null&quot;;
-        return &quot;jsDateOrNaN(state, $value)&quot; if $handlingForNaN eq &quot;NaN&quot;;
-        die &quot;Unknown value for TreatReturnedNaNDateAs extended attribute&quot;;
</del><ins>+        return &quot;jsDateOrNull(state, $value)&quot; if $signature-&gt;isNullable;
+        return &quot;jsDate(state, $value)&quot;;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if ($codeGenerator-&gt;IsNumericType($type) or $type eq &quot;DOMTimeStamp&quot;) {
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsIDLAttributestxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt (205743 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt        2016-09-09 15:42:13 UTC (rev 205743)
+++ trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -119,7 +119,6 @@
</span><span class="cx"> SkipVTableValidation
</span><span class="cx"> SuppressToJSObject
</span><span class="cx"> TreatNullAs=EmptyString
</span><del>-TreatReturnedNaNDateAs=Null|NaN
</del><span class="cx"> TypedArray=*
</span><span class="cx"> URL
</span><span class="cx"> Unforgeable
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLInputElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLInputElement.idl (205743 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLInputElement.idl        2016-09-09 15:42:13 UTC (rev 205743)
+++ trunk/Source/WebCore/html/HTMLInputElement.idl        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -60,7 +60,7 @@
</span><span class="cx">     attribute DOMString defaultValue;
</span><span class="cx">     // See the discussion in https://bugs.webkit.org/show_bug.cgi?id=100085
</span><span class="cx">     [TreatNullAs=EmptyString, SetterRaisesException] attribute DOMString value;
</span><del>-    [SetterRaisesException] attribute Date valueAsDate;
</del><ins>+    [SetterRaisesException] attribute Date? valueAsDate;
</ins><span class="cx">     [SetterRaisesException] attribute unrestricted double valueAsNumber;
</span><span class="cx"> 
</span><span class="cx">     [RaisesException] void stepUp(optional long n = 1);
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMediaElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (205743 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMediaElement.cpp        2016-09-09 15:42:13 UTC (rev 205743)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -1138,6 +1138,8 @@
</span><span class="cx"> 
</span><span class="cx"> double HTMLMediaElement::getStartDate() const
</span><span class="cx"> {
</span><ins>+    if (!m_player)
+        return std::numeric_limits&lt;double&gt;::quiet_NaN();
</ins><span class="cx">     return m_player-&gt;getStartDate().toDouble();
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMediaElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMediaElement.idl (205743 => 205744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMediaElement.idl        2016-09-09 15:42:13 UTC (rev 205743)
+++ trunk/Source/WebCore/html/HTMLMediaElement.idl        2016-09-09 16:17:19 UTC (rev 205744)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     // playback state
</span><span class="cx">     [SetterRaisesException] attribute unrestricted double currentTime;
</span><span class="cx">     readonly attribute unrestricted double duration;
</span><del>-    [TreatReturnedNaNDateAs=NaN] Date getStartDate();
</del><ins>+    Date getStartDate();
</ins><span class="cx">     readonly attribute boolean paused;
</span><span class="cx">     attribute unrestricted double defaultPlaybackRate;
</span><span class="cx">     attribute unrestricted double playbackRate;
</span></span></pre>
</div>
</div>

</body>
</html>