Comment # 5 on bug 1094141 from Martin Wilck

Well, there's a possibility that this happens.

> DJ9xxVIP::DJ9xxVIP
> (
>     SystemServices* pSS,
>     BOOL proto
> ) :
>     Printer(pSS, NUM_DJ6XX_FONTS, proto),
>     PCL3acceptsDriverware(TRUE)
> {
> 
>     m_bVIPPrinter = TRUE;
> 
>     if (!proto && IOMode.bDevID)
>     {
>         bCheckForCancelButton = TRUE;
>         constructor_error = VerifyPenInfo();
>         CERRCHECK;
>     }
>     else ePen = BOTH_PENS;    // matches default mode
> 
>     PCL3acceptsDriverware = IsPCL3DriverwareAvailable();
> 
>     ModeCount = 0;
>     pMode[ModeCount++] = new GrayModeDJ990(ulMapDJ600_CCM_K,PCL3acceptsDriverware);  // Grayscale K
>

If VerifyPenInfo() returns an error, CERRCHECK is called, which means that the
constructor returns without setting ModeCount = 0 and intializing the base
class modes.

The subclass constructor doesn't regard the same condition as an error, and
continues happily:

> DJGenericVIP::DJGenericVIP (SystemServices* pSS, BOOL proto)
>     : DJ9xxVIP (pSS, proto)
> {
> 
>     if (!proto && IOMode.bDevID)
>     {
>         bCheckForCancelButton = TRUE;
>         constructor_error = VerifyPenInfo ();
>         if (constructor_error != NO_ERROR)
>         {
>             constructor_error = NO_ERROR;
>             ePen = BOTH_PENS;
>         }
>     }
>     else
>         ePen = BOTH_PENS;
>   [...]
>   pMode[ModeCount++] = new VIPFastDraftMode ();        // Fast Draft

In this case, ModeCount is 2 before the VIPFastDraftMode() call, and
pMode[0] and pMode[1] are NULL, as we observe in the core.

This looks like an obvious hplip bug to me. The reason why you haven't seen it
before must be related to VerifyPenInfo(). This function fails if the printer
is inaccessible, or if no pens (cartridges?) are available, or if it's a
printer model that needs all pens (cartridges?) installed to function.