[Win32] Table tooltip indexes cell font with subitem -1
维护者通常 1 天内回复
评估
调研方向
从 Table.positionTooltip() 开始,追踪原生 hit-test 结果如何传递到 TableItem.fontHandle();检查复现用例中表格外的命中情况,此时 iSubItem == -1。在访问单元格字体之前检查子项边界,并考虑在 TableItem.fontHandle() 中进行防御性边界处理。验证表格外的通知不再抛出异常,并且有效单元格的工具提示在 Windows 上仍可正常工作。
由索引模型根据 Issue 内容生成。
描述
Describe the bug
On Windows, Table tooltip handling can throw ArrayIndexOutOfBoundsException when LVM_SUBITEMHITTEST returns a nonnegative row index but iSubItem == -1. A point left of the table at first-row height produces this result on the tested runtime, with LVHT_NOWHERE set. Table.positionTooltip() checks only the return value and passes the invalid subitem to TableItem.fontHandle(), which indexes cellFont[-1].
This was first observed as an unhandled event-loop exception in Trace Compass. A standalone SWT reproducer and the real TMF Events table reproduce the same failure without an input trace.
java.lang.ArrayIndexOutOfBoundsException: Index -1 out of bounds for length 22
at org.eclipse.swt.widgets.TableItem.fontHandle(TableItem.java:156)
at org.eclipse.swt.widgets.Table.positionTooltip(Table.java:7152)
at org.eclipse.swt.widgets.Table.wmNotifyToolTip(Table.java:7127)
at org.eclipse.swt.widgets.Table.wmNotify(Table.java:6467)
at org.eclipse.swt.widgets.Control.WM_NOTIFY(Control.java:5584)
To Reproduce
Run the following main class with the Windows SWT jar. It creates a hidden 22-column table with per-cell fonts and moves only its shell so the last-message position is left of the table. It then deliberately sends a native TTN_GETDISPINFO notification. The hit-test result is produced by Windows; no hook, reflection, injected hit-test result, or patched SWT jar is used.
The sequence verifies: original failure; no failure with setToolTipText(""); failure again after restoring null; successful notification for a valid cell. The original spontaneous mouse gesture and notification timing have not been reconstructed. This snippet reproduces the failing notification path, rather than automating that gesture.
Standalone reproducer
import org.eclipse.swt.SWT;
import org.eclipse.swt.graphics.Font;
import org.eclipse.swt.internal.win32.*;
import org.eclipse.swt.widgets.*;
/** Reproduce native cell-tooltip handling of a real off-table hit. */
public class TableTooltipBoundsReproducer {
/** Move only the hidden test window so the last message lies at this point. */
private static LVHITTESTINFO position(Shell shell, Table table, int x, int y) {
POINT message = new POINT();
OS.POINTSTOPOINT(message, OS.GetMessagePos());
OS.ScreenToClient(table.handle, message);
RECT bounds = new RECT();
OS.GetWindowRect(shell.handle, bounds);
OS.SetWindowPos(shell.handle, 0, bounds.left + message.x - x, bounds.top + message.y - y,
0, 0, OS.SWP_NOSIZE | OS.SWP_NOZORDER | OS.SWP_NOACTIVATE);
OS.POINTSTOPOINT(message, OS.GetMessagePos());
OS.ScreenToClient(table.handle, message);
LVHITTESTINFO hit = new LVHITTESTINFO();
hit.x = message.x; hit.y = message.y;
long row = OS.SendMessage(table.handle, OS.LVM_SUBITEMHITTEST, 0, hit);
System.out.println("HIT point=" + hit.x + "," + hit.y + " result=" + row + " item=" + hit.iItem + " column=" + hit.iSubItem + " flags=" + hit.flags);
if (row != 0 || hit.iItem != 0) throw new AssertionError("Expected actual first-row hit");
return hit;
}
/** Invoke the table's actual native notification path, with no hit-test hook. */
private static void notify(Table table) {
NMTTDISPINFO info = new NMTTDISPINFO();
info.hwndFrom = OS.SendMessage(table.handle, OS.LVM_GETTOOLTIPS, 0, 0);
info.code = OS.TTN_GETDISPINFO;
long memory = OS.HeapAlloc(OS.GetProcessHeap(), OS.HEAP_ZERO_MEMORY, NMTTDISPINFO.sizeof);
if (memory == 0) throw new AssertionError("Notification allocation failed");
try {
OS.MoveMemory(memory, info, NMTTDISPINFO.sizeof);
OS.SendMessage(table.handle, OS.WM_NOTIFY, 0, memory);
} finally { OS.HeapFree(OS.GetProcessHeap(), 0, memory); }
}
/** Verify failure, localized tooltip suppression, restoration and valid hits. */
public static void main(String[] args) {
Display display = new Display();
Shell shell = new Shell(display);
Font font = new Font(display, "Segoe UI", 10, SWT.BOLD);
try {
shell.setSize(800, 400);
Table table = new Table(shell, SWT.MULTI | SWT.FULL_SELECTION | SWT.NO_SCROLL);
table.setBounds(0, 0, 600, 250);
table.setHeaderVisible(true);
for (int i = 0; i < 22; i++) {
TableColumn column = new TableColumn(table, SWT.NONE);
column.setText("Column " + i);
column.setWidth(80);
column.setToolTipText("Header tooltip " + i);
}
TableItem item = new TableItem(table, SWT.NONE);
item.setText(0, "Search row");
for (int i = 0; i < 22; i++) item.setFont(i, font);
int y = table.getHeaderHeight() + table.getItemHeight() / 2;
for (boolean suppress : new boolean[] { false, true, false }) {
table.setToolTipText(suppress ? "" : null);
LVHITTESTINFO hit = position(shell, table, -10, y);
if (hit.iSubItem != -1) throw new AssertionError("Expected actual negative column");
try {
notify(table);
if (!suppress) throw new AssertionError("Expected original tooltip exception");
if (!"Header tooltip 0".equals(table.getColumn(0).getToolTipText())) throw new AssertionError("Header tooltip changed");
System.out.println("PASS suppressed native cell tooltip; header tooltip retained");
} catch (ArrayIndexOutOfBoundsException e) {
if (suppress || !e.getStackTrace()[0].getMethodName().equals("fontHandle")) throw e;
System.out.println("PASS baseline actual native failure: " + e);
for (int i = 0; i < Math.min(9, e.getStackTrace().length); i++) System.out.println(" at " + e.getStackTrace()[i]);
}
}
LVHITTESTINFO valid = position(shell, table, 10, y);
if (valid.iSubItem != 0) throw new AssertionError("Valid cell missing");
notify(table);
System.out.println("PASS valid in-table native cell notification");
} finally { shell.dispose(); font.dispose(); display.dispose(); }
}
}
Expected behavior
An off-table hit should be rejected without accessing a cell font or throwing an event-loop exception. Valid cell tooltips should continue to work. Please consider checking the subitem bounds before acquiring the device context in Table.positionTooltip(), with defensive bounds handling in TableItem.fontHandle() as appropriate.
Environment
- Windows 11, version 10.0.26300, x86_64.
- Java 21.0.12.
- Win32 SWT
3.135.0.v20260819-1952, used by the tested Trace Compass 12.1 environment. - Linux and macOS were not tested for this defect. A display-scaling cause has not been established.
Version since
Confirmed with the bundle above. The first affected version is unknown.
Workaround / additional context
table.setToolTipText("") avoids the native cell-tooltip path in the standalone reproducer and in the actual TMF Events table; restoring null reproduces the exception again. The tradeoff is losing the table's default cell-text popups. Header-tooltip values and custom hover-listener identities remain intact; their visual popup behavior was not verified by these diagnostics.
The native TMF diagnostic passed one JUnit test, with zero failures/errors/skips and JVM exit 0. The original failure had a 22-element font array, matching the Events table's per-cell-font search row. Other column counts may also be affected; 22 is the tested case.
- 主要语言
- Java
- 星标
- 202
- 派生
- 206
- 平均合并
- 1 天 17 小时
- 30 天内合并 PR
- 109
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
eclipse-platform/eclipse.platform.swt 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 75/100
eclipse-platform/eclipse.platform.swt#3761 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
eclipse-platform/eclipse.platform.swt#3546 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
eclipse-platform/eclipse.platform.swt#3428 ·
维护者通常 1 天内回复
-
难度 1/5 1-3 小时 新手友好度 75/100
eclipse-platform/eclipse.platform.swt#3336 · 3 条评论 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 52/100
eclipse-platform/eclipse.platform.swt#3763 ·
维护者通常 1 天内回复
查看 eclipse-platform/eclipse.platform.swt 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 72/100
geonetwork/core-geonetwork#9592 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
NationalSecurityAgency/ghidra#10040 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 63/100
维护者通常 1 天内回复
-
[Bug] ServerHttpRequest.getURI() throws NumberFormatException when Host contains an explicit port未关闭component/need-triage type/need-triage
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
apache/rocketmq-dashboard#7361 ·
维护者通常 3 天内回复