317420 - Firefox 1.5RC3 crashes when trying to print a page [@ lexpsnt3.dll - CompositeBitsInMemory ][@ IIAAE1DD.dll - CompositeBitsInMemory ]

Status: RESOLVED FIXED

(Core Graveyard :: GFX: Win32, defect)

Description

[jgoldsti]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 (CK-IBM) Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 (CK-IBM) Firefox/1.5

I tried to print a page from a website onto my Lexmark Optra R+ Postscript printer and Firefox crashed. This does not happen with IE6.1.This has now happened on two different websites.

Reproducible: Always

Steps to Reproduce:
1.Open webiste
2.Print page
3.

Actual Results:  
Firefox crashes 

Expected Results:  
Page prints

This first happened on a Better business bureau website.

Comment 1

[Adam Guthrie]

Could you install with talkback and get a talkback ID for the crash? http://kb.mozillazine.org/Talkback

Comment 2

[timeless]

probably a dupe of the bad hp printer drivers crash gecko bugs. but i'd need either a talkback report or windbg output to be sure.

Comment 3

[jgoldsti]

I recreated the problem with talkback installed. The talkback ID is: 
TB12141531Z.

Let me know if you need anything else to get this debugged.  By the way, I'll try printing to an HP officejet and see if it acts up with another printer (it crashed when trying to print to a Lexmark Optra R+ Poscript level 2 driver).

Comment 4

[jgoldsti]

I did some more testing and Firefox only crashes with the Lexmark Optra R+ Postscript 2 driver.  It does not crash with the PCL or Postscript 3 drivers or when printing to an HP Officejet 4200 attached to the same machine. IE 6.1 does not have problems with this driver.

Comment 5

[Adam Hauner]

Stack Signature	 lexpsnt3.dll + 0x87e3 (0x01f887e3) e5be528b
Product ID	Firefox15
Build ID	2005111116
Trigger Time	2005-11-22 10:43:03.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	lexpsnt3.dll + (000087e3)
URL visited	http://dsl.sbc.yahoo.com/
User Comments	Tried to print this url. Same problem occurs with other urls as well.
Since Last Crash	42531 sec
Total Uptime	42531 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
lexpsnt3.dll + 0x87e3 (0x01f887e3)
lexpsnt3.dll + 0x89c5 (0x01f889c5)
lexpsnt3.dll + 0x8ab5 (0x01f88ab5)
GDI32.dll + 0x18751 (0x77f28751)
USER32.dll + 0x203fb (0x77d603fb)
ntdll.dll + 0xeae3 (0x7c90eae3)
CompositeBitsInMemory  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/gfx/src/windows/nsImageWin.cpp, line 2050]
nsImageWin::Draw  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/gfx/src/windows/nsImageWin.cpp, line 577]
nsRenderingContextImpl::DrawImage  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/gfx/src/shared/nsRenderingContextImpl.cpp, line 378]
nsImageFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsImageFrame.cpp, line 1403]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
nsHTMLContainerFrame::PaintDecorationsAndChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsInlineFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsInlineFrame.cpp, line 327]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsBlockFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h, line 287]
nsBlockFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6441]
nsHTMLContainerFrame::PaintDecorationsAndChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6268]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
nsTableCellFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/nsTableCellFrame.cpp, line 440]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
nsTableRowFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/nsTableRowFrame.cpp, line 561]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
...

related bugs: 251976, 273998 and 303845?

Comment 6

[timeless]

*** Bug 251976 has been marked as a duplicate of this bug. ***

Comment 7

[timeless]

*** Bug 303845 has been marked as a duplicate of this bug. ***

Comment 8

[timeless]

*** Bug 273998 has been marked as a duplicate of this bug. ***

Comment 9

[timeless]

the fix for this and the fix for the hp bug will be the same, lots of SEH code around anything that could possibly call into a buggy printer driver.

Comment 10

[jgoldsti]

I found the same problem with the IBM 1312 Postscript 3 drivers (I believe they are developed by Lexmark).  The talkback record is TB12344716G.

Comment 11

[Adam Hauner]

Incident ID: 12344716
Stack Signature	IIAAE1DD.dll + 0xe02a (0x0343e02a) 8e247a0c
Product ID	Firefox15
Build ID	2005111116
Trigger Time	2005-11-28 07:23:27.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	IIAAE1DD.dll + (0000e02a)
URL visited	
User Comments	Firefox crashed when trying to print using the IBM 1312 PS3 driver.
Since Last Crash	8409 sec
Total Uptime	66202 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
IIAAE1DD.dll + 0xe02a (0x0343e02a)
IIAAE1DD.dll + 0xe20c (0x0343e20c)
IIAAE1DD.dll + 0xe2fc (0x0343e2fc)
GDI32.dll + 0x18751 (0x77f28751)
USER32.dll + 0x203fb (0x77d603fb)
ntdll.dll + 0xeae3 (0x7c90eae3)
CompositeBitsInMemory  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/gfx/src/windows/nsImageWin.cpp, line 2050]
nsImageWin::Draw  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/gfx/src/windows/nsImageWin.cpp, line 577]
nsRenderingContextImpl::DrawImage  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/gfx/src/shared/nsRenderingContextImpl.cpp, line 378]
nsImageFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsImageFrame.cpp, line 1403]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsBlockFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h, line 287]
nsBlockFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6441]
nsHTMLContainerFrame::PaintDecorationsAndChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
...

Comment 12

[timeless]

*** Bug 318183 has been marked as a duplicate of this bug. ***

Comment 13

[timeless]

*** Bug 322188 has been marked as a duplicate of this bug. ***

Comment 14

[Aydin Dilber]

(In reply to comment #0)
> User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8)
> Gecko/20051111 (CK-IBM) Firefox/1.5
> Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8)
> Gecko/20051111 (CK-IBM) Firefox/1.5
> 
> I tried to print a page from a website onto my Lexmark Optra R+ Postscript
> printer and Firefox crashed. This does not happen with IE6.1.This has now
> happened on two different websites.
> 
> Reproducible: Always
> 
> Steps to Reproduce:
> 1.Open webiste
> 2.Print page
> 3.
> 
> Actual Results:  
> Firefox crashes 
> 
> Expected Results:  
> Page prints
> 
> This first happened on a Better business bureau website.
> 

Comment 15

[Aydin Dilber]

I also noticed crashes when trying to print at least a dozen pages with Firefox 1.5 and a Lexmark X422 MFP PostScript driver. No other program has any problem with this and the pages do print fine with IE 6.x. Now after reading here I will try to print with the PCL dirver in the future...

Comment 16

[Mike Kaply [:mkaply] (Out until 9/29)]

Are these drivers that ship with Windows or do I have to go download them from Lexmark?

Comment 17

[Tony Hansen]

You'd probably be best off getting the drivers from Lexmark. For me at least, on earlier advice while trying to track down this bug, I had switched to the Lexmark drivers. And I still have the problem in both firefox and thunderbird.

Comment 18

[Mike Kaply [:mkaply] (Out until 9/29)]

What should I install to recreate?

 	 	MPWNXPAE.exe  	 	 	 	Version 1.5
					
	Postscript Level 3 Driver for Microsoft Windows XP and Server 2003 				 File Information
		MPLX2K2E.EXE 				Version 7.4.1
					
	Postscript Driver for Windows 2000, XP and Server 2003

Comment 19

[Mike Kaply [:mkaply] (Out until 9/29)]

Attachment: Image for testcase

Comment 20

[Mike Kaply [:mkaply] (Out until 9/29)]

Attachment: Testcase for crash

We've done lots of research on this and we have a testcase.

It has to do with absolutely postioning things to a very exact position.

It appears to be a driver bug combined with an optimizer bug since if I unoptimize Firefox 1.5 or use VC8, the problem doesn't happen.

We are continuing to research the problem.

Comment 21

[Mike Kaply [:mkaply] (Out until 9/29)]

Attachment: Workaround for problem

Opt and nonopt were doing different precision in some transform computations.

By adding a function call in the middle, we workaround the problem.

Comment 22

[Mike Kaply [:mkaply] (Out until 9/29)]

This is a blocker request. This bug is causing major headaches for our 1.5.0.1 rollout inside of IBM.

I need this in 1.5.0.2 so I can make many thousands of IBM employees happy.

Comment 23

[Mike Kaply [:mkaply] (Out until 9/29)]

Attachment: Proper patch that uses compiler version

Using MSC_VER so this only happens on Windows and VC6

Comment 24

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 212943 [details] [diff] [review]
Proper patch that uses compiler version

The risk is about zero.

Comment 25

[Mike Kaply [:mkaply] (Out until 9/29)]

Comment on attachment 212943 [details] [diff] [review]
Proper patch that uses compiler version

I need this on 1.8.0.2 as well

Comment 26

[Daniel Veditz [:dveditz]]

Please land this on trunk and 1.8 branch so the fix can be verified before it's approved for the 1.8.0 update branch.

Comment 27

[Mike Kaply [:mkaply] (Out until 9/29)]

roc, is there any benefit to having this on the trunk?

Comment 28

[Robert O'Callahan (:roc) (email my personal email if necessary)]

We can land it on the trunk, but I don't think you can currently build the trunk with VC6 anymore (because VC6 can't build cairo reliably). So it won't really have any effect.

Comment 29

[Daniel Veditz [:dveditz]]

Comment on attachment 212943 [details] [diff] [review]
Proper patch that uses compiler version

approved for 1.8.0 branch, a=dveditz for drivers

Comment 30

[Daniel Veditz [:dveditz]]

fix checked into 1.8.0 branch

Comment 31

[Mike Kaply [:mkaply] (Out until 9/29)]

I verified this problem does not exist with VC8 so I am not landing this on the trunk.

Comment 32

[Dave Liebreich [:davel]]

Could someone at IBM grab a recent nightly 1.8.0 build and verify that the problem has been fixed?  Thanks.

Comment 33

[Mario Sebastiani]

(In reply to comment #32)
> Could someone at IBM grab a recent nightly 1.8.0 build and verify that the
> problem has been fixed?  Thanks.
> 

I've tried but the problem seems still here... Can you point out a specific build to download?

Comment 34

[Mike Kaply [:mkaply] (Out until 9/29)]

Builds from here:

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla1.8.0/

Comment 35

[Mike Kaply [:mkaply] (Out until 9/29)]

ARGH. This specific problem is fixed. But there is a second driver specific crash. I'm investigating now.

Comment 36

[Mike Kaply [:mkaply] (Out until 9/29)]

I've opened

https://bugzilla.mozilla.org/show_bug.cgi?id=329299

for the other problem.

I have verified this specific problem is fixed with a downloaded build

The other problem is different.

Comment 37

[(no longer active)]

Can someone who has access to the buggy printer driver please test the following build, and see if the crash happens or not?

<http://www.mcsmurf.de/mozilla/firefox-trunk-20060821-print.zip>

I have written a patch which I think should fix this problem, but I don't have
access to such a printer to test it.  Thanks!