Hacktoberfest 2026:维护者为十月标记出来的 issue,仍然开放、适合新手。 浏览 Hacktoberfest issue

[Win32] Table tooltip indexes cell font with subitem -1

未关闭 适合新手
#3,752 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@fdesbiens 已经在做这个了。

开始于 2026年10月20日。

  • #3753 来自 @fdesbiens —— 未关闭

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
76/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
java
领域
backend, desktop

调研方向

从 Table.positionTooltip() 开始,追踪原生 hit-test 结果如何传递到 TableItem.fontHandle();检查复现用例中表格外的命中情况,此时 iSubItem == -1。在访问单元格字体之前检查子项边界,并考虑在 TableItem.fontHandle() 中进行防御性边界处理。验证表格外的通知不再抛出异常,并且有效单元格的工具提示在 Windows 上仍可正常工作。

由索引模型根据 Issue 内容生成。

描述

Describe the bug

On Windows, Table tooltip handling can throw ArrayIndexOutOfBoundsException when LVM_SUBITEMHITTEST returns a nonnegative row index but iSubItem == -1. A point left of the table at first-row height produces this result on the tested runtime, with LVHT_NOWHERE set. Table.positionTooltip() checks only the return value and passes the invalid subitem to TableItem.fontHandle(), which indexes cellFont[-1].

This was first observed as an unhandled event-loop exception in Trace Compass. A standalone SWT reproducer and the real TMF Events table reproduce the same failure without an input trace.

java.lang.ArrayIndexOutOfBoundsException: Index -1 out of bounds for length 22
    at org.eclipse.swt.widgets.TableItem.fontHandle(TableItem.java:156)
    at org.eclipse.swt.widgets.Table.positionTooltip(Table.java:7152)
    at org.eclipse.swt.widgets.Table.wmNotifyToolTip(Table.java:7127)
    at org.eclipse.swt.widgets.Table.wmNotify(Table.java:6467)
    at org.eclipse.swt.widgets.Control.WM_NOTIFY(Control.java:5584)

To Reproduce

Run the following main class with the Windows SWT jar. It creates a hidden 22-column table with per-cell fonts and moves only its shell so the last-message position is left of the table. It then deliberately sends a native TTN_GETDISPINFO notification. The hit-test result is produced by Windows; no hook, reflection, injected hit-test result, or patched SWT jar is used.

The sequence verifies: original failure; no failure with setToolTipText(""); failure again after restoring null; successful notification for a valid cell. The original spontaneous mouse gesture and notification timing have not been reconstructed. This snippet reproduces the failing notification path, rather than automating that gesture.

Standalone reproducer
import org.eclipse.swt.SWT;
import org.eclipse.swt.graphics.Font;
import org.eclipse.swt.internal.win32.*;
import org.eclipse.swt.widgets.*;

/** Reproduce native cell-tooltip handling of a real off-table hit. */
public class TableTooltipBoundsReproducer {
    /** Move only the hidden test window so the last message lies at this point. */
    private static LVHITTESTINFO position(Shell shell, Table table, int x, int y) {
        POINT message = new POINT();
        OS.POINTSTOPOINT(message, OS.GetMessagePos());
        OS.ScreenToClient(table.handle, message);
        RECT bounds = new RECT();
        OS.GetWindowRect(shell.handle, bounds);
        OS.SetWindowPos(shell.handle, 0, bounds.left + message.x - x, bounds.top + message.y - y,
                0, 0, OS.SWP_NOSIZE | OS.SWP_NOZORDER | OS.SWP_NOACTIVATE);
        OS.POINTSTOPOINT(message, OS.GetMessagePos());
        OS.ScreenToClient(table.handle, message);
        LVHITTESTINFO hit = new LVHITTESTINFO();
        hit.x = message.x; hit.y = message.y;
        long row = OS.SendMessage(table.handle, OS.LVM_SUBITEMHITTEST, 0, hit);
        System.out.println("HIT point=" + hit.x + "," + hit.y + " result=" + row + " item=" + hit.iItem + " column=" + hit.iSubItem + " flags=" + hit.flags);
        if (row != 0 || hit.iItem != 0) throw new AssertionError("Expected actual first-row hit");
        return hit;
    }

    /** Invoke the table's actual native notification path, with no hit-test hook. */
    private static void notify(Table table) {
        NMTTDISPINFO info = new NMTTDISPINFO();
        info.hwndFrom = OS.SendMessage(table.handle, OS.LVM_GETTOOLTIPS, 0, 0);
        info.code = OS.TTN_GETDISPINFO;
        long memory = OS.HeapAlloc(OS.GetProcessHeap(), OS.HEAP_ZERO_MEMORY, NMTTDISPINFO.sizeof);
        if (memory == 0) throw new AssertionError("Notification allocation failed");
        try {
            OS.MoveMemory(memory, info, NMTTDISPINFO.sizeof);
            OS.SendMessage(table.handle, OS.WM_NOTIFY, 0, memory);
        } finally { OS.HeapFree(OS.GetProcessHeap(), 0, memory); }
    }

    /** Verify failure, localized tooltip suppression, restoration and valid hits. */
    public static void main(String[] args) {
        Display display = new Display();
        Shell shell = new Shell(display);
        Font font = new Font(display, "Segoe UI", 10, SWT.BOLD);
        try {
            shell.setSize(800, 400);
            Table table = new Table(shell, SWT.MULTI | SWT.FULL_SELECTION | SWT.NO_SCROLL);
            table.setBounds(0, 0, 600, 250);
            table.setHeaderVisible(true);
            for (int i = 0; i < 22; i++) {
                TableColumn column = new TableColumn(table, SWT.NONE);
                column.setText("Column " + i);
                column.setWidth(80);
                column.setToolTipText("Header tooltip " + i);
            }
            TableItem item = new TableItem(table, SWT.NONE);
            item.setText(0, "Search row");
            for (int i = 0; i < 22; i++) item.setFont(i, font);
            int y = table.getHeaderHeight() + table.getItemHeight() / 2;
            for (boolean suppress : new boolean[] { false, true, false }) {
                table.setToolTipText(suppress ? "" : null);
                LVHITTESTINFO hit = position(shell, table, -10, y);
                if (hit.iSubItem != -1) throw new AssertionError("Expected actual negative column");
                try {
                    notify(table);
                    if (!suppress) throw new AssertionError("Expected original tooltip exception");
                    if (!"Header tooltip 0".equals(table.getColumn(0).getToolTipText())) throw new AssertionError("Header tooltip changed");
                    System.out.println("PASS suppressed native cell tooltip; header tooltip retained");
                } catch (ArrayIndexOutOfBoundsException e) {
                    if (suppress || !e.getStackTrace()[0].getMethodName().equals("fontHandle")) throw e;
                    System.out.println("PASS baseline actual native failure: " + e);
                    for (int i = 0; i < Math.min(9, e.getStackTrace().length); i++) System.out.println("  at " + e.getStackTrace()[i]);
                }
            }
            LVHITTESTINFO valid = position(shell, table, 10, y);
            if (valid.iSubItem != 0) throw new AssertionError("Valid cell missing");
            notify(table);
            System.out.println("PASS valid in-table native cell notification");
        } finally { shell.dispose(); font.dispose(); display.dispose(); }
    }
}

Expected behavior

An off-table hit should be rejected without accessing a cell font or throwing an event-loop exception. Valid cell tooltips should continue to work. Please consider checking the subitem bounds before acquiring the device context in Table.positionTooltip(), with defensive bounds handling in TableItem.fontHandle() as appropriate.

Environment

  • Windows 11, version 10.0.26300, x86_64.
  • Java 21.0.12.
  • Win32 SWT 3.135.0.v20260819-1952, used by the tested Trace Compass 12.1 environment.
  • Linux and macOS were not tested for this defect. A display-scaling cause has not been established.

Version since

Confirmed with the bundle above. The first affected version is unknown.

Workaround / additional context

table.setToolTipText("") avoids the native cell-tooltip path in the standalone reproducer and in the actual TMF Events table; restoring null reproduces the exception again. The tradeoff is losing the table's default cell-text popups. Header-tooltip values and custom hover-listener identities remain intact; their visual popup behavior was not verified by these diagnostics.

The native TMF diagnostic passed one JUnit test, with zero failures/errors/skips and JVM exit 0. The original failure had a 22-element font array, matching the Events table's per-cell-font search row. Other column counts may also be affected; 22 is the tested case.

主要语言
Java
星标
202
派生
206
平均合并
1 天 17 小时
30 天内合并 PR
109

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue,再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库,在一个分支上完成修改。
  4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

eclipse-platform/eclipse.platform.swt 的其他 Issue

查看 eclipse-platform/eclipse.platform.swt 的全部 Issue

相似的 Issue

更多 Java Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。