Last Comment Bug 669084 - Crash [@ nsPrintEngine::DoCommonPrint][@ nsDeviceContext::GetDeviceSurfaceDimensions] with onbeforeprint="window.print"
: Crash [@ nsPrintEngine::DoCommonPrint][@ nsDeviceContext::GetDeviceSurfaceDim...
[sg:dos] null deref
: crash, regression, testcase
Product: Core
Classification: Components
Component: Printing: Output (show other bugs)
: Trunk
: x86 Windows 7
-- critical (vote)
: mozilla8
Assigned To: Olli Pettay [:smaug]
: Jet Villegas (:jet)
Depends on:
Blocks: 307258
  Show dependency treegraph
Reported: 2011-07-03 11:01 PDT by Martijn Wargers [:mwargers]
Modified: 2011-11-06 23:25 PST (History)
1 user (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

testcase (37 bytes, text/html)
2011-07-03 11:01 PDT, Martijn Wargers [:mwargers]
no flags Details
patch (1.43 KB, patch)
2011-07-05 03:58 PDT, Olli Pettay [:smaug]
roc: review+
Details | Diff | Splinter Review

Description User image Martijn Wargers [:mwargers] 2011-07-03 11:01:10 PDT
Created attachment 543681 [details]

See testcase, when trying to print or print preview that page, pressing cancel will open a new print dialog (annoying).
When you press "Ok", Mozilla crashes.
I guess a regression from bug 307258.
0 	xul.dll 	nsDeviceContext::GetDeviceSurfaceDimensions 	gfx/src/nsDeviceContext.cpp:515
1 	xul.dll 	nsPrintEngine::ReflowPrintObject 	layout/printing/nsPrintEngine.cpp:1914
2 	xul.dll 	nsPrintEngine::ReflowDocList 	layout/printing/nsPrintEngine.cpp:1860
3 	xul.dll 	nsPrintEngine::SetupToPrintContent 	layout/printing/nsPrintEngine.cpp:1669
4 	xul.dll 	nsPrintEngine::DocumentReadyForPrinting 	layout/printing/nsPrintEngine.cpp:1501
5 	xul.dll 	nsPrintEngine::Observe 	layout/printing/nsPrintEngine.cpp:3344
6 	xul.dll 	nsPrintProgress::DoneIniting 	embedding/components/printingui/src/win/nsPrintProgress.cpp:222
7 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
8 	xul.dll 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1592
9 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:656
10 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4085
11 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:613
12 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:686
0 	xul.dll 	nsPrintEngine::DoCommonPrint 	layout/printing/nsPrintEngine.cpp:654
1 	xul.dll 	nsPrintEngine::CommonPrint 	layout/printing/nsPrintEngine.cpp:444
2 	xul.dll 	nsPrintEngine::Print 	layout/printing/nsPrintEngine.cpp:759
3 	xul.dll 	DocumentViewerImpl::Print 	layout/base/nsDocumentViewer.cpp:3679
4 	xul.dll 	nsGlobalWindow::Print 	dom/base/nsGlobalWindow.cpp:5175
5 	xul.dll 	nsGlobalWindow::Print 	dom/base/nsGlobalWindow.cpp:5140
6 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
7 	xul.dll 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1592
8 	mozjs.dll 	CallCompiler::generateNativeStub 	js/src/methodjit/MonoIC.cpp:813
9 	mozjs.dll 	js::mjit::ic::NativeCall 	js/src/methodjit/MonoIC.cpp:1031
10 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:686
11 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:733
12 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:610
13 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:686
Comment 1 User image Olli Pettay [:smaug] 2011-07-03 11:54:59 PDT
Marking ss until I've investigated this.
Comment 2 User image Olli Pettay [:smaug] 2011-07-05 03:58:51 PDT
Created attachment 543905 [details] [diff] [review]

Let's fix this in the simple way.
Comment 3 User image Robert O'Callahan (:roc) (email my personal email if necessary) 2011-07-05 17:41:41 PDT
Comment on attachment 543905 [details] [diff] [review]

Review of attachment 543905 [details] [diff] [review]:
Comment 4 User image Olli Pettay [:smaug] 2011-07-06 05:15:21 PDT

The patch fixes the crash, but the loop - if cancel is pressed - is of course still there. That is just a loop in the js code.
Comment 5 User image Martijn Wargers [:mwargers] 2011-07-07 07:32:07 PDT
Verified fixed. Thanks for fixing.
One question, though. I don't get a loop when I press Ok for printing? Why is that?
Comment 6 User image Olli Pettay [:smaug] 2011-07-07 08:31:16 PDT
Because then we enter printing and the added check cancels the loop.
Comment 7 User image Daniel Veditz [:dveditz] 2011-07-14 12:01:56 PDT
The stack from comment 0 is a null deref. Are there cases where it won't be? If this isn't a security problem we should un-hide the bug. If it is we need to decide whether it's worth fixing for Firefox 6 and 7. Given the user-interaction required this is probably sg:moderate at worst; a null deref would be sg:dos.

Note You need to log in before you can comment on or make changes to this bug.