Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Win32] Table tooltip indexes cell font with subitem -1

Aperta Adatta ai principianti
  • Qualcosa non va?
#3,752 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@fdesbiens ci sta già lavorando.

Dal 20/10/2026.

  • #3753 di @fdesbiens — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
76/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
java
Ambito
backend, desktop

Direzione di ricerca

Inizia da Table.positionTooltip() e segui il percorso del risultato nativo dell’hit-test fino a TableItem.fontHandle(); esamina l’hit fuori dalla tabella del riproduttore, dove iSubItem == -1. Controlla i limiti del sottoelemento prima di accedere al font della cella e valuta una gestione difensiva dei limiti in TableItem.fontHandle(). Verifica che le notifiche fuori dalla tabella non generino più eccezioni e che i tooltip delle celle valide continuino a funzionare su Windows.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the bug

On Windows, Table tooltip handling can throw ArrayIndexOutOfBoundsException when LVM_SUBITEMHITTEST returns a nonnegative row index but iSubItem == -1. A point left of the table at first-row height produces this result on the tested runtime, with LVHT_NOWHERE set. Table.positionTooltip() checks only the return value and passes the invalid subitem to TableItem.fontHandle(), which indexes cellFont[-1].

This was first observed as an unhandled event-loop exception in Trace Compass. A standalone SWT reproducer and the real TMF Events table reproduce the same failure without an input trace.

java.lang.ArrayIndexOutOfBoundsException: Index -1 out of bounds for length 22
    at org.eclipse.swt.widgets.TableItem.fontHandle(TableItem.java:156)
    at org.eclipse.swt.widgets.Table.positionTooltip(Table.java:7152)
    at org.eclipse.swt.widgets.Table.wmNotifyToolTip(Table.java:7127)
    at org.eclipse.swt.widgets.Table.wmNotify(Table.java:6467)
    at org.eclipse.swt.widgets.Control.WM_NOTIFY(Control.java:5584)

To Reproduce

Run the following main class with the Windows SWT jar. It creates a hidden 22-column table with per-cell fonts and moves only its shell so the last-message position is left of the table. It then deliberately sends a native TTN_GETDISPINFO notification. The hit-test result is produced by Windows; no hook, reflection, injected hit-test result, or patched SWT jar is used.

The sequence verifies: original failure; no failure with setToolTipText(""); failure again after restoring null; successful notification for a valid cell. The original spontaneous mouse gesture and notification timing have not been reconstructed. This snippet reproduces the failing notification path, rather than automating that gesture.

Standalone reproducer 
import org.eclipse.swt.SWT;
import org.eclipse.swt.graphics.Font;
import org.eclipse.swt.internal.win32.*;
import org.eclipse.swt.widgets.*;

/** Reproduce native cell-tooltip handling of a real off-table hit. */
public class TableTooltipBoundsReproducer {
    /** Move only the hidden test window so the last message lies at this point. */
    private static LVHITTESTINFO position(Shell shell, Table table, int x, int y) {
        POINT message = new POINT();
        OS.POINTSTOPOINT(message, OS.GetMessagePos());
        OS.ScreenToClient(table.handle, message);
        RECT bounds = new RECT();
        OS.GetWindowRect(shell.handle, bounds);
        OS.SetWindowPos(shell.handle, 0, bounds.left + message.x - x, bounds.top + message.y - y,
                0, 0, OS.SWP_NOSIZE | OS.SWP_NOZORDER | OS.SWP_NOACTIVATE);
        OS.POINTSTOPOINT(message, OS.GetMessagePos());
        OS.ScreenToClient(table.handle, message);
        LVHITTESTINFO hit = new LVHITTESTINFO();
        hit.x = message.x; hit.y = message.y;
        long row = OS.SendMessage(table.handle, OS.LVM_SUBITEMHITTEST, 0, hit);
        System.out.println("HIT point=" + hit.x + "," + hit.y + " result=" + row + " item=" + hit.iItem + " column=" + hit.iSubItem + " flags=" + hit.flags);
        if (row != 0 || hit.iItem != 0) throw new AssertionError("Expected actual first-row hit");
        return hit;
    }

    /** Invoke the table's actual native notification path, with no hit-test hook. */
    private static void notify(Table table) {
        NMTTDISPINFO info = new NMTTDISPINFO();
        info.hwndFrom = OS.SendMessage(table.handle, OS.LVM_GETTOOLTIPS, 0, 0);
        info.code = OS.TTN_GETDISPINFO;
        long memory = OS.HeapAlloc(OS.GetProcessHeap(), OS.HEAP_ZERO_MEMORY, NMTTDISPINFO.sizeof);
        if (memory == 0) throw new AssertionError("Notification allocation failed");
        try {
            OS.MoveMemory(memory, info, NMTTDISPINFO.sizeof);
            OS.SendMessage(table.handle, OS.WM_NOTIFY, 0, memory);
        } finally { OS.HeapFree(OS.GetProcessHeap(), 0, memory); }
    }

    /** Verify failure, localized tooltip suppression, restoration and valid hits. */
    public static void main(String[] args) {
        Display display = new Display();
        Shell shell = new Shell(display);
        Font font = new Font(display, "Segoe UI", 10, SWT.BOLD);
        try {
            shell.setSize(800, 400);
            Table table = new Table(shell, SWT.MULTI | SWT.FULL_SELECTION | SWT.NO_SCROLL);
            table.setBounds(0, 0, 600, 250);
            table.setHeaderVisible(true);
            for (int i = 0; i < 22; i++) {
                TableColumn column = new TableColumn(table, SWT.NONE);
                column.setText("Column " + i);
                column.setWidth(80);
                column.setToolTipText("Header tooltip " + i);
            }
            TableItem item = new TableItem(table, SWT.NONE);
            item.setText(0, "Search row");
            for (int i = 0; i < 22; i++) item.setFont(i, font);
            int y = table.getHeaderHeight() + table.getItemHeight() / 2;
            for (boolean suppress : new boolean[] { false, true, false }) {
                table.setToolTipText(suppress ? "" : null);
                LVHITTESTINFO hit = position(shell, table, -10, y);
                if (hit.iSubItem != -1) throw new AssertionError("Expected actual negative column");
                try {
                    notify(table);
                    if (!suppress) throw new AssertionError("Expected original tooltip exception");
                    if (!"Header tooltip 0".equals(table.getColumn(0).getToolTipText())) throw new AssertionError("Header tooltip changed");
                    System.out.println("PASS suppressed native cell tooltip; header tooltip retained");
                } catch (ArrayIndexOutOfBoundsException e) {
                    if (suppress || !e.getStackTrace()[0].getMethodName().equals("fontHandle")) throw e;
                    System.out.println("PASS baseline actual native failure: " + e);
                    for (int i = 0; i < Math.min(9, e.getStackTrace().length); i++) System.out.println("  at " + e.getStackTrace()[i]);
                }
            }
            LVHITTESTINFO valid = position(shell, table, 10, y);
            if (valid.iSubItem != 0) throw new AssertionError("Valid cell missing");
            notify(table);
            System.out.println("PASS valid in-table native cell notification");
        } finally { shell.dispose(); font.dispose(); display.dispose(); }
    }
}

Expected behavior

An off-table hit should be rejected without accessing a cell font or throwing an event-loop exception. Valid cell tooltips should continue to work. Please consider checking the subitem bounds before acquiring the device context in Table.positionTooltip(), with defensive bounds handling in TableItem.fontHandle() as appropriate.

Environment

  • Windows 11, version 10.0.26300, x86_64.
  • Java 21.0.12.
  • Win32 SWT 3.135.0.v20260819-1952, used by the tested Trace Compass 12.1 environment.
  • Linux and macOS were not tested for this defect. A display-scaling cause has not been established.

Version since

Confirmed with the bundle above. The first affected version is unknown.

Workaround / additional context

table.setToolTipText("") avoids the native cell-tooltip path in the standalone reproducer and in the actual TMF Events table; restoring null reproduces the exception again. The tradeoff is losing the table's default cell-text popups. Header-tooltip values and custom hover-listener identities remain intact; their visual popup behavior was not verified by these diagnostics.

The native TMF diagnostic passed one JUnit test, with zero failures/errors/skips and JVM exit 0. The original failure had a 22-element font array, matching the Events table's per-cell-font search row. Other column counts may also be affected; 22 is the tested case.

Lingua principale
Java
Stelle
202
Fork
206
Merge medio
21h 55m
PR unite (30g)
110

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di eclipse-platform/eclipse.platform.swt

Tutte le issue di eclipse-platform/eclipse.platform.swt

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.