Bug 1558067. Prevent mozPrintCallback being invoked with the wrong <canvas> element. r=bobowen

Since the Firefox print preview code creates a static clone from the existing
print preview static clone for any print preview settings changes, for enabling
of simplified mode, and for a print from a print preview document,
HTMLCanvasElement::CopyInnerTo may be invoked on an existing static clone.
In that case, the mozPrintCallback's printState.context.canvas would previously
have ended up using the canvas in the previous print preview static clone,
which is wrong, and allow the callback to modify the static clone document.

Differential Revision: https://phabricator.services.mozilla.com/D34294

--HG--
extra : rebase_source : ef9b360bac674a22cbc3c505ce30089a9d25bb22
extra : amend_source : f449821674a4b4aa45df924f89eec015cae907a9

dom/html/HTMLCanvasElement.cpp

@@ -520,7 +520,9 @@ nsresult HTMLCanvasElement::CopyInnerTo(HTMLCanvasElement* aDest) {
   nsresult rv = nsGenericHTMLElement::CopyInnerTo(aDest);
   NS_ENSURE_SUCCESS(rv, rv);
   if (aDest->OwnerDoc()->IsStaticDocument()) {
-    aDest->mOriginalCanvas = this;
+    // The Firefox print preview code can create a static clone from an
+    // existing static clone, so we may not be the original 'canvas' element.
+    aDest->mOriginalCanvas = GetOriginalCanvas();
 
     // We make sure that the canvas is not zero sized since that would cause
     // the DrawImage call below to return an error, which would cause printing