461283 - Crash [@ fastcopy_I ] - printing broken

Status: VERIFIED FIXED

(Core :: Widget: Win32, defect)

Description

[John]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b2pre) Gecko/20081022 Minefield/3.1b2pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b2pre) Gecko/20081022 Minefield/3.1b2pre

Browser crashes when pressing the OK button on the print dialog when printing to a PDF. I did not try to print to a regular printer at this time

Crash Report: http://crash-stats.mozilla.com/report/index/92294657-a085-11dd-bfe1-001a4bd43ef6

Reproducible: Always

Steps to Reproduce:
1. Visit http://www.fairfieldmirror.com/news/university_college_refuses_to_comment_on_cheating
2.Press the print button on the webpage (top right side of the article above the picture)
3. The print dialog will appear. Press OK
4. 
Actual Results:  
Browser crashes

Expected Results:  
The page should print

Comment 1

[(mostly gone) XtC4UaLL [:xtc4uall]]

bp-5bd697c2-a0b7-11dd-804a-001321b13766 (Minefield/3.1b2pre ID:20081022033543)
bp-c6b79528-a0b7-11dd-86eb-001321b13766 (Minefield/3.1b2pre ID:20081022033543)

Signature	fastcopy_I
UUID	5bd697c2-a0b7-11dd-804a-001321b13766
Time	2008-10-22 21:00:28-07
Uptime	224
Product	Firefox
Version	3.1b2pre
Build ID	20081022033543
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x1d67000
Comments	

Frame 	Module 	Signature 	Source
0 	mozcrt19.dll 	fastcopy_I 	
1 	mozcrt19.dll 	_VEC_memcpy 	
2 	mozcrt19.dll 	_VEC_memcpy 	
3 	xul.dll 	nsPrintSettingsWin::CopyDevMode(_devicemodeW*,_devicemodeW*&) 	widget/src/windows/nsPrintSettingsWin.cpp:118
4 	xul.dll 	nsPrintSettingsWin::SetDevMode(_devicemodeW*) 	widget/src/windows/nsPrintSettingsWin.cpp:144
5 	kernel32.dll 	kernel32.dll@0xff11

this is not limited to pdf printing, but trying to print to any installed printer in windows. if you just get the "an unknown error has occurred" message try again the printing steps and the crash will happen.

from http://forums.mozillazine.org/viewtopic.php?p=4798625#p4798625 the regrange is:
20081021182718 works
20081021185233 fails

by this and the stacktrace i presume this is because of Bug 460979 => CCing Joshua for comment.

Comment 2

[Reed Loden [:reed]]

Bug 344111 affected only Linux (GTK+) code, so there's no way it could be causing a crash on Windows. Try again. :)

Comment 3

[Reed Loden [:reed]]

(In reply to comment #2)
> Bug 344111 affected only Linux (GTK+) code, so there's no way it could be
> causing a crash on Windows. Try again. :)

Uh, not sure how I came up with that bug number, but I meant bug 460979.

Comment 4

[(mostly gone) XtC4UaLL [:xtc4uall]]

arrg, you're right. but then only http://hg.mozilla.org/mozilla-central/rev/0b9819e66ace (Bug 459674, which made changes in that timeframe to nsPrintSettingsWin.cpp) remains by my wild guessing :-).

Comment 5

[Brad Lassey [:blassey] (use needinfo?)]

the crash is happening in the memcpy here:
http://mxr.mozilla.org/mozilla-central/source/widget/src/windows/nsPrintSettingsWin.cpp#118

I assume size is wrong

Comment 6

[Brad Lassey [:blassey] (use needinfo?)]

Attachment: switches from DEVMODE and PRINTDLG to DEVMODEW and PRINTDLGW

This fixes the crash for me.

Comment 7

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Comment on attachment 344589 [details] [diff] [review]
switches from DEVMODE and PRINTDLG to DEVMODEW and PRINTDLGW


>@@ -897,20 +894,19 @@
>   if (!printerName) return NS_ERROR_FAILURE;
> 
>   // Now create a DEVNAMES struct so the the dialog is initialized correctly.
>-  nsCAutoString tempPrinterName;
>-  rv = NS_CopyUnicodeToNative(nsDependentString(printerName), tempPrinterName);
>-  NS_ENSURE_SUCCESS(rv, rv);
>+  nsAutoString tempPrinterName(printerName);
> 
>   PRUint32 len = tempPrinterName.Length();
>-  hDevNames = (HGLOBAL)::GlobalAlloc(GHND, len+sizeof(DEVNAMES)+1);
>+  hDevNames = (HGLOBAL)::GlobalAlloc(GHND, sizeof(wchar_t) * (len + 1) + 
>+                                     sizeof(DEVNAMES));
>   DEVNAMES* pDevNames = (DEVNAMES*)::GlobalLock(hDevNames);
>   pDevNames->wDriverOffset = sizeof(DEVNAMES);
>   pDevNames->wDeviceOffset = sizeof(DEVNAMES);
>   pDevNames->wOutputOffset = sizeof(DEVNAMES)+len+1;
>   pDevNames->wDefault      = 0;
> 
>-  char* device = &(((char*)pDevNames)[pDevNames->wDeviceOffset]);
>-  strcpy(device, tempPrinterName.get());
>+  wchar_t* device = &(((wchar_t*)pDevNames)[pDevNames->wDeviceOffset]);
>+  wcscpy(device, tempPrinterName.get());
>   ::GlobalUnlock(hDevNames);
> 


I don't think you need the tempPrinterName temporary any more -- you should be able to just use printerName, no?  I don't know what type printerName is.  r+ either way.

Comment 8

[Brad Lassey [:blassey] (use needinfo?)]

Attachment: removed tempPrinterName

carrying vlad's r+

Comment 9

[Brad Lassey [:blassey] (use needinfo?)]

changeset:   20801:95f09bc4d690
tag:         tip
user:        Brad Lassey <[e-mail]>
date:        Fri Oct 24 01:21:15 2008 -0400
summary:     Bug 461283 -  Crash [@ fastcopy_I ] - printing broken r=vlad

Comment 11

[Diego]

Is this bug back again or are these reports caused by something else?

http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&version=Firefox%3A3.1b2pre&signature=fastcopy_I

Comment 12

[Steffen Wilberg]

No, printing works fine here.

Comment 13

[Diego]

(In reply to comment #11)
> Is this bug back again or are these reports caused by something else?
> 
> http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&version=Firefox%3A3.1b2pre&signature=fastcopy_I

Whatever it was it has been solved in 20081114 nightly.
Sorry for the bugspam.

Comment 14

[:Gavin Sharp [email: [e-mail]]]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/95f09bc4d690