1655746 - Crash in [@ mozilla::dom::Promise::MaybeSomething<T>] from WebProgressListenerToPromise::OnStatusChange

Status: VERIFIED FIXED

(Core :: Printing: Output, defect, P2)

Description

[Emil Ghitta, QA [:emilghitta]]

This bug is for crash report bp-d28bef28-4856-41f3-94e0-7a3ee0200728.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::Promise::MaybeSomething<mozilla::ErrorResult> dom/promise/Promise.h:318
1 xul.dll WebProgressListenerToPromise::OnStatusChange dom/base/nsFrameLoader.cpp:3146
2 xul.dll nsPrintData::DoOnStatusChange layout/printing/nsPrintData.cpp:115
3 xul.dll nsPrintJob::FirePrintingErrorEvent layout/printing/nsPrintJob.cpp:1321
4 xul.dll nsDocumentViewer::Print layout/base/nsDocumentViewer.cpp:3172
5 xul.dll nsFrameLoader::Print dom/base/nsFrameLoader.cpp:3226
6 xul.dll mozilla::dom::FrameLoader_Binding::print_promiseWrapper dom/bindings/FrameLoaderBinding.cpp:746
7 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises> dom/bindings/BindingUtils.cpp:3220
8 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:577
9 xul.dll Interpret js/src/vm/Interpreter.cpp:3333

Affected versions

• 81.0a1 (BuildId:20200727203201)
• 80.0b1 (BuildId:20200727193419)

Unaffected versions

• 68.10.0esr (BuildId:20200622191537)
• 79.0 (BuildId:20200720193547)
• 78.1.0esr (BuildId:20200722151235)

Affected platforms

• Windows 10 64bit
• Ubuntu 18.04 64bit

Unaffected platforms

• macOS 10.14

Steps to reproduce

1. Launch Firefox.
2. Access the about:support page.
3. Hit CTRL + P.
4. Select the print to PDF option.
5. Click the Print button.
6. Click the X button from the preparing dialog before the “Save print output as” prompt is displayed.
7. Repeat step 3.
8. Close the “Print Preview error ” panel.
9. Repeat step 3.

Expected result

• Firefox is stable and the about:support can be successfully printed.

Actual result

• Firefox Crashes.

Regression Range

• This seems to be a regression.
• Since this leads to a Firefox crash it will require to manually investigate and find the regressor. I will investigate this as soon as time permits.

Notes

• [Suggested Severity] Since this leads to a browser crash, I think that this fits under the S2 severity.

Comment 1

[Emil Ghitta, QA [:emilghitta]]

Attachment: printCrash.gif

Comment 2

[Emil Ghitta, QA [:emilghitta]]

On Ubuntu 18.04, there is a different signature involved (same STR)-> bp-06b6f047-754f-49f6-87c1-16b170200728
(I'm wondering if I should file a separate bug for Ubuntu's crash signature)

Comment 3

[Emilio Cobos Álvarez (:emilio)]

I think this is a regression from bug 1652270. It seems we can end up with multiple error notifications, and the second one ends up in a null deref.

Jonathan, can you take this?

Comment 4

[Julien Cristau [:jcristau]]

Based on the crash volume in 80.0b1 I'm going to call this a blocker; this is almost 10% of the browser crashes so far.

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1655746 - Avoid crashing when getting error notifications from printing. r=jwatt

We could legitimately get multiple error notifications and we'd try to
reject the promise twice and crash.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/43702cb83da8
Avoid crashing when getting error notifications from printing. r=jwatt

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/43702cb83da8

Comment 8

[Julien Cristau [:jcristau]]

Please request beta uplift when you get a chance, I'd like to have this in b3.

Comment 9

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 9167092 [details]
Bug 1655746 - Avoid crashing when getting error notifications from printing. r=jwatt

Beta/Release Uplift Approval Request

• User impact if declined: printing crashes.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: There seems to be some STR above.
• List of other uplifts needed: none
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): missing null-check
• String changes made/needed: none

Comment 10

[Julien Cristau [:jcristau]]

Comment on attachment 9167092 [details]
Bug 1655746 - Avoid crashing when getting error notifications from printing. r=jwatt

thanks :)

Comment 11

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/releases/mozilla-beta/rev/5356bfd2f6f2

Comment 12

[Emil Ghitta, QA [:emilghitta]]

This issue is verified fixed using Firefox 81.0a1 (BuildId:20200802214843) and Firefox 80.0b3 (BuildId:20200803045446) on Windows 10 64bit and Ubuntu 18.04 64bit.

Marking this as verified fixed since I can no longer reproduce this crash using the STR from comment 0

Also, it seems that this fix exposed an older behavior mentioned in Bug 1656887.