236904 - Opening msgPrintEngine.xul as chrome URI in browser crashes Mozilla

Status: VERIFIED FIXED

(MailNews Core :: Printing, defect)

Description

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040308

Opening the specified chrome URI in the browser window crashes Mozilla. The
crash occurs while the variable `printSettings'
(content\messenger\msgPrintEngine.js) is not initialized correctly when opening
the window directly. It keeps it's `null' value within function
InitPrintEngineWindow() when opening directly without specifying any window
arguments. So the function call printEngine.startPrintOperation(printSettings)
results in a crash.

Comment 1

[Rene Pronk]

Confirming Moz 1.7a

Before it crashes I get a "You can't dereference a NULL nsCOMPtr with
operator->()." assertion right here. It crashes immediately after the assertion.


http://lxr.mozilla.org/seamonkey/source/mailnews/base/src/nsMsgPrintEngine.cpp#384

379   // Turning off the showing of Print Progress in Prefs overrides
380   // whether the calling PS desire to have it on or off, so only check PS if 
381   // prefs says it's ok to be on.
382   if (showProgressDialog) 
383   {
384     mPrintSettings->GetShowPrintProgress(&showProgressDialog);
385   }



NTDLL! 77f75a58()
nsDebugImpl::Assertion(nsDebugImpl * const 0x002e6d38, const char * 0x03871c1c
`string', const char * 0x03871c58 `string', const char * 0x03871c68 `string',
int 670) line 272
nsDebug::Assertion(const char * 0x03871c1c `string', const char * 0x03871c58
`string', const char * 0x03871c68 `string', int 670) line 109
nsCOMPtr<nsIPrintSettings>::operator->() line 670 + 34 bytes
nsMsgPrintEngine::ShowProgressDialog(int 1, int & 0) line 384 + 15 bytes
nsMsgPrintEngine::FireThatLoadOperationStartup(nsMsgPrintEngine * const
0x02e3e8e8, nsString * 0x02ed3418) line 501 + 25 bytes
nsMsgPrintEngine::StartNextPrintOperation(nsMsgPrintEngine * const 0x02e3e8e8)
line 463 + 16 bytes
nsMsgPrintEngine::StartPrintOperation(nsMsgPrintEngine * const 0x02e3e8e8,
nsIPrintSettings * 0x00000000) line 349
XPTC_InvokeByIndex(nsISupports * 0x02e3e8e8, unsigned int 9, unsigned int 1,
nsXPTCVariant * 0x0012d7c8) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 2022 + 42 bytes
XPC_WN_CallMethod(JSContext * 0x029537d0, JSObject * 0x02c350d8, unsigned int 1,
long * 0x02eb70b4, long * 0x0012da98) line 1287 + 14 bytes
js_Invoke(JSContext * 0x029537d0, unsigned int 1, unsigned int 0) line 941 + 23
bytes
js_Interpret(JSContext * 0x029537d0, long * 0x0012e3cc) line 2962 + 15 bytes
js_Invoke(JSContext * 0x029537d0, unsigned int 1, unsigned int 2) line 958 + 13
bytes
js_InternalInvoke(JSContext * 0x029537d0, JSObject * 0x02c363c0, long 43991504,
unsigned int 0, unsigned int 1, long * 0x0012e644, long * 0x0012e640) line 1035
+ 20 bytes
JS_CallFunctionValue(JSContext * 0x029537d0, JSObject * 0x02c363c0, long
43991504, unsigned int 1, long * 0x0012e644, long * 0x0012e640) line 3592 + 31 bytes
nsJSContext::CallEventHandler(JSObject * 0x02c363c0, JSObject * 0x029f41d0,
unsigned int 1, long * 0x0012e644, long * 0x0012e640) line 1267 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x02e75d30, nsIDOMEvent
* 0x02e3c688) line 174 + 52 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x02e75df0,
nsIDOMEvent * 0x02e3c688, nsIDOMEventTarget * 0x02d15c08, unsigned int 1,
unsigned int 2) line 1434 + 20 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x02e64910,
nsIPresContext * 0x00000000, nsEvent * 0x0012f2fc, nsIDOMEvent * * 0x0012f254,
nsIDOMEventTarget * 0x02d15c08, unsigned int 2, nsEventStatus * 0x0012f324) line
1527 + 56 bytes
GlobalWindowImpl::HandleDOMEvent(nsIPresContext * 0x00000000, nsEvent *
0x0012f2fc, nsIDOMEvent * * 0x0012f254, unsigned int 2, nsEventStatus *
0x0012f324) line 890
nsXULDocument::HandleDOMEvent(nsIPresContext * 0x00000000, nsEvent * 0x0012f2fc,
nsIDOMEvent * * 0x0012f254, unsigned int 2, nsEventStatus * 0x0012f324) line 1246
nsXULElement::HandleDOMEvent(nsIPresContext * 0x00000000, nsEvent * 0x0012f2fc,
nsIDOMEvent * * 0x0012f254, unsigned int 2, nsEventStatus * 0x0012f324) line
2904 + 54 bytes
nsXULElement::HandleDOMEvent(nsIPresContext * 0x00000000, nsEvent * 0x0012f2fc,
nsIDOMEvent * * 0x0012f254, unsigned int 7, nsEventStatus * 0x0012f324) line
2898 + 56 bytes
GlobalWindowImpl::HandleDOMEvent(nsIPresContext * 0x02e3fe38, nsEvent *
0x0012f38c, nsIDOMEvent * * 0x0012f350, unsigned int 7, nsEventStatus *
0x0012f3b4) line 938 + 45 bytes
DocumentViewerImpl::LoadComplete(DocumentViewerImpl * const 0x02e672a0, unsigned
int 0) line 911 + 35 bytes
nsDocShell::EndPageLoad(nsIWebProgress * 0x02ea3ea4, nsIChannel * 0x02ea45c8,
unsigned int 0) line 4328
nsWebShell::EndPageLoad(nsIWebProgress * 0x02ea3ea4, nsIChannel * 0x02ea45c8,
unsigned int 0) line 752
nsDocShell::OnStateChange(nsDocShell * const 0x02e9b03c, nsIWebProgress *
0x02ea3ea4, nsIRequest * 0x02ea45c8, unsigned int 131088, unsigned int 0) line 4260
nsDocLoaderImpl::FireOnStateChange(nsIWebProgress * 0x02ea3ea4, nsIRequest *
0x02ea45c8, int 131088, unsigned int 0) line 1225
nsDocLoaderImpl::doStopDocumentLoad(nsIRequest * 0x02ea45c8, unsigned int 0)
line 863
nsDocLoaderImpl::DocLoaderIsEmpty() line 761
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x02ea3e94, nsIRequest *
0x02ea45c8, nsISupports * 0x00000000, unsigned int 0) line 691
nsLoadGroup::RemoveRequest(nsLoadGroup * const 0x02ea4080, nsIRequest *
0x02ea45c8, nsISupports * 0x00000000, unsigned int 0) line 695 + 35 bytes
nsInputStreamChannel::OnStopRequest(nsInputStreamChannel * const 0x02ea45cc,
nsIRequest * 0x02ea4700, nsISupports * 0x00000000, unsigned int 0) line 371
nsInputStreamPump::OnStateStop() line 499
nsInputStreamPump::OnInputStreamReady(nsInputStreamPump * const 0x02ea4704,
nsIAsyncInputStream * 0x02ea47dc) line 339 + 11 bytes
nsInputStreamReadyEvent::EventHandler(PLEvent * 0x02ea4e14) line 119
PL_HandleEvent(PLEvent * 0x02ea4e14) line 671 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00a06ee0) line 606 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00060394, unsigned int 49419, unsigned int 0,
long 10514144) line 1412 + 9 bytes
USER32! 77d43a50()
USER32! 77d43b1f()
USER32! 77d43d79()
USER32! 77d43ddf()
nsAppShellService::Run(nsAppShellService * const 0x00a65078) line 484
main1(int 1, char * * 0x002e2638, nsISupports * 0x00a04dd8) line 1291 + 32 bytes
main(int 1, char * * 0x002e2638) line 1678 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e814c7()

Comment 2

[Rene Pronk]

Attachment: Patch

This fixes it for me.

Comment 3

[Rene Pronk]

Comment on attachment 143389 [details] [diff] [review]
Patch

Requesting superreview.
Not sure who can review this. Do we need a review for a patch this simple?

Comment 4

[Rene Pronk]

Comment on attachment 143389 [details] [diff] [review]
Patch

Neil, can you review this?

If it's ok with you, feel free to check it in. I don't have permission to do 
it myself. Thanks.

Comment 5

[[e-mail]]

Comment on attachment 143389 [details] [diff] [review]
Patch

Sorry for the delay, but I didn't have time to fix my tree earlier :-( If you
need it I can still check this in for you once you get a=

Comment 6

[Rene Pronk]

Comment on attachment 143389 [details] [diff] [review]
Patch

Requesting approval for this patch. It's a one line patch that add a simple
null check to nsMsgPrintEngine.cpp in order to prevent a crash.

sr=mscott
r=neil

Comment 7

[Mike Kaply [:mkaply]]

Comment on attachment 143389 [details] [diff] [review]
Patch

a=mkaply since it's a crasher

Comment 8

[Rene Pronk]

Neil, I got the a=mkaply so can you check this is for me? Thanks.

Comment 9

[[e-mail]]

Fix checked in.