Closed Bug 1655746 Opened 1 year ago Closed 1 year ago

Crash in [@ mozilla::dom::Promise::MaybeSomething<T>] from WebProgressListenerToPromise::OnStatusChange

Categories

(Core :: Printing: Output, defect, P2)

defect

Tracking

()

VERIFIED FIXED
81 Branch
Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- unaffected
firefox79 --- unaffected
firefox80 blocking verified
firefox81 + verified

People

(Reporter: emilghitta, Assigned: emilio)

References

(Blocks 2 open bugs, Regression)

Details

(Keywords: crash, regression, topcrash, Whiteboard: [print2020_v81])

Crash Data

Attachments

(2 files)

This bug is for crash report bp-d28bef28-4856-41f3-94e0-7a3ee0200728.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::Promise::MaybeSomething<mozilla::ErrorResult> dom/promise/Promise.h:318
1 xul.dll WebProgressListenerToPromise::OnStatusChange dom/base/nsFrameLoader.cpp:3146
2 xul.dll nsPrintData::DoOnStatusChange layout/printing/nsPrintData.cpp:115
3 xul.dll nsPrintJob::FirePrintingErrorEvent layout/printing/nsPrintJob.cpp:1321
4 xul.dll nsDocumentViewer::Print layout/base/nsDocumentViewer.cpp:3172
5 xul.dll nsFrameLoader::Print dom/base/nsFrameLoader.cpp:3226
6 xul.dll mozilla::dom::FrameLoader_Binding::print_promiseWrapper dom/bindings/FrameLoaderBinding.cpp:746
7 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises> dom/bindings/BindingUtils.cpp:3220
8 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:577
9 xul.dll Interpret js/src/vm/Interpreter.cpp:3333

Affected versions

  • 81.0a1 (BuildId:20200727203201)
  • 80.0b1 (BuildId:20200727193419)

Unaffected versions

  • 68.10.0esr (BuildId:20200622191537)
  • 79.0 (BuildId:20200720193547)
  • 78.1.0esr (BuildId:20200722151235)

Affected platforms

  • Windows 10 64bit
  • Ubuntu 18.04 64bit

Unaffected platforms

  • macOS 10.14

Steps to reproduce

  1. Launch Firefox.
  2. Access the about:support page.
  3. Hit CTRL + P.
  4. Select the print to PDF option.
  5. Click the Print button.
  6. Click the X button from the preparing dialog before the “Save print output as” prompt is displayed.
  7. Repeat step 3.
  8. Close the “Print Preview error ” panel.
  9. Repeat step 3.

Expected result

  • Firefox is stable and the about:support can be successfully printed.

Actual result

  • Firefox Crashes.

Regression Range

  • This seems to be a regression.
  • Since this leads to a Firefox crash it will require to manually investigate and find the regressor. I will investigate this as soon as time permits.

Notes

  • [Suggested Severity] Since this leads to a browser crash, I think that this fits under the S2 severity.
Attached image printCrash.gif
Has Regression Range: --- → no
Has STR: --- → yes
OS: Windows 10 → All
Version: Firefox 81 → Trunk

On Ubuntu 18.04, there is a different signature involved (same STR)-> bp-06b6f047-754f-49f6-87c1-16b170200728
(I'm wondering if I should file a separate bug for Ubuntu's crash signature)

I think this is a regression from bug 1652270. It seems we can end up with multiple error notifications, and the second one ends up in a null deref.

Jonathan, can you take this?

Severity: -- → S2
Flags: needinfo?(jwatt)
Priority: -- → P2
Regressed by: 1652270
Summary: Crash in [@ mozilla::dom::Promise::MaybeSomething<T>] → Crash in [@ mozilla::dom::Promise::MaybeSomething<T>] from WebProgressListenerToPromise::OnStatusChange
Has Regression Range: no → yes
Whiteboard: [print2020_v81]

Based on the crash volume in 80.0b1 I'm going to call this a blocker; this is almost 10% of the browser crashes so far.

We could legitimately get multiple error notifications and we'd try to
reject the promise twice and crash.

Assignee: nobody → emilio
Status: NEW → ASSIGNED
Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/43702cb83da8
Avoid crashing when getting error notifications from printing. r=jwatt
Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → 81 Branch

Please request beta uplift when you get a chance, I'd like to have this in b3.

Flags: needinfo?(emilio)

Comment on attachment 9167092 [details]
Bug 1655746 - Avoid crashing when getting error notifications from printing. r=jwatt

Beta/Release Uplift Approval Request

  • User impact if declined: printing crashes.
  • Is this code covered by automated tests?: No
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: Yes
  • If yes, steps to reproduce: There seems to be some STR above.
  • List of other uplifts needed: none
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): missing null-check
  • String changes made/needed: none
Flags: needinfo?(emilio)
Attachment #9167092 - Flags: approval-mozilla-beta?
Flags: qe-verify+

Comment on attachment 9167092 [details]
Bug 1655746 - Avoid crashing when getting error notifications from printing. r=jwatt

thanks :)

Flags: needinfo?(jwatt)
Attachment #9167092 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
QA Whiteboard: [qa-triaged]

This issue is verified fixed using Firefox 81.0a1 (BuildId:20200802214843) and Firefox 80.0b3 (BuildId:20200803045446) on Windows 10 64bit and Ubuntu 18.04 64bit.

Marking this as verified fixed since I can no longer reproduce this crash using the STR from comment 0

Also, it seems that this fix exposed an older behavior mentioned in Bug 1656887.

Status: RESOLVED → VERIFIED
Flags: qe-verify+
Blocks: 1631440
Blocks: 1557682
You need to log in before you can comment on or make changes to this bug.