667092 - Crash [@ DocumentViewerImpl::Print] with onbeforeprint

Status: VERIFIED FIXED

(Core :: Printing: Output, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build. I guess a regression of bug 307258.

https://crash-stats.mozilla.com/report/index/bp-19109731-87bb-4b70-b586-98d902110624
0 	xul.dll 	DocumentViewerImpl::Print 	layout/base/nsDocumentViewer.cpp:3694
1 	xul.dll 	nsGlobalWindow::Print 	dom/base/nsGlobalWindow.cpp:5112
2 	xul.dll 	nsGlobalWindow::Print 	dom/base/nsGlobalWindow.cpp:5077
3 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
4 	xul.dll 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1607
5 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:656
6 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4550
7 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:613
8 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:686
9 	mozjs.dll 	js::ExternalInvoke 	js/src/jsinterp.cpp:805
10 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5098
11 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1900
12 	xul.dll 	nsGlobalWindow::RunTimeout 	dom/base/nsGlobalWindow.cpp:9211
13 	xul.dll 	nsGlobalWindow::TimerCallback 	dom/base/nsGlobalWindow.cpp:9552
14 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:424
15 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:520
16 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:618
17 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
18 	xul.dll 	xul.dll@0xb6560f 
etc..

The iframe content is this:
<script>
setTimeout(function() {window.print();}, 10);
</script>
<frameset onbeforeprint="window.frameElement.parentNode.removeChild(window.frameElement)"></frameset>"

Comment 1

[Daniel Veditz [:dveditz]]

Going to assume Olli hid the bug because it looks exploitable. It's a near-null dereference, but hard to see how that works given the code flagged in the crash-stack, so it's hard to say if the bad value could end up being something else or used in a bad way.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

This looks indeed a nullpointer crash.
Patch coming.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: patch

If ::Destroy is called because of beforeprint, mDeviceContext becomes null.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/52ba94702d12

Comment 5

[Jesse Ruderman]

I made changes to my DOM fuzzer that should allow it to find bugs like this (but with very low probability, I think).  1a3951936f66, 3e91c7dcea51

Comment 6

[Asa Dotzler [:asa]]

We'll get to this approval requests on Monday's 2pm PT triage.

Comment 7

[Johnathan Nightingale [:johnath]]

Comment on attachment 543243 [details] [diff] [review]
patch

Get it in quickly, please!

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/releases/mozilla-beta/rev/4137513fe932

Comment 9

[u279076]

qa+ for fix verification in Firefox 7

Comment 10

[Al Billings [:abillings - ex-MoCo]]

Verified that the testcase no longer crashes on Win7 with Firefox 7: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0) Gecko/20100101 Firefox/7.0

Comment 11

[Al Billings [:abillings - ex-MoCo]]

No crash on OS X 10.7 with Firefox 7 either: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:7.0) Gecko/20100101 Firefox/7.0

Comment 12

[u279076]

Verified fixed based on comment 10 and 11.