Repository navigation
[Win32] Table tooltip indexes cell font with subitem -1 #3752
Description
Describe the bug
On Windows, Table tooltip handling can throw ArrayIndexOutOfBoundsException when LVM_SUBITEMHITTEST returns a nonnegative row index but iSubItem == -1. A point left of the table at first-row height produces this result on the tested runtime, with LVHT_NOWHERE set. Table.positionTooltip() checks only the return value and passes the invalid subitem to TableItem.fontHandle(), which indexes cellFont[-1].
This was first observed as an unhandled event-loop exception in Trace Compass. A standalone SWT reproducer and the real TMF Events table reproduce the same failure without an input trace.
java.lang.ArrayIndexOutOfBoundsException: Index -1 out of bounds for length 22
at org.eclipse.swt.widgets.TableItem.fontHandle(TableItem.java:156)
at org.eclipse.swt.widgets.Table.positionTooltip(Table.java:7152)
at org.eclipse.swt.widgets.Table.wmNotifyToolTip(Table.java:7127)
at org.eclipse.swt.widgets.Table.wmNotify(Table.java:6467)
at org.eclipse.swt.widgets.Control.WM_NOTIFY(Control.java:5584)
To Reproduce
Run the following main class with the Windows SWT jar. It creates a hidden 22-column table with per-cell fonts and moves only its shell so the last-message position is left of the table. It then deliberately sends a native TTN_GETDISPINFO notification. The hit-test result is produced by Windows; no hook, reflection, injected hit-test result, or patched SWT jar is used.
The sequence verifies: original failure; no failure with setToolTipText(""); failure again after restoring null; successful notification for a valid cell. The original spontaneous mouse gesture and notification timing have not been reconstructed. This snippet reproduces the failing notification path, rather than automating that gesture.
Standalone reproducer
import org.eclipse.swt.SWT;
import org.eclipse.swt.graphics.Font;
import org.eclipse.swt.internal.win32.*;
import org.eclipse.swt.widgets.*;
/** Reproduce native cell-tooltip handling of a real off-table hit. */
public class TableTooltipBoundsReproducer {
/** Move only the hidden test window so the last message lies at this point. */
private static LVHITTESTINFO position(Shell shell, Table table, int x, int y) {
POINT message = new POINT();
OS.POINTSTOPOINT(message, OS.GetMessagePos());
OS.ScreenToClient(table.handle, message);
RECT bounds = new RECT();
OS.GetWindowRect(shell.handle, bounds);
OS.SetWindowPos(shell.handle, 0, bounds.left + message.x - x, bounds.top + message.y - y,
0, 0, OS.SWP_NOSIZE | OS.SWP_NOZORDER | OS.SWP_NOACTIVATE);
OS.POINTSTOPOINT(message, OS.GetMessagePos());
OS.ScreenToClient(table.handle, message);
LVHITTESTINFO hit = new LVHITTESTINFO();
hit.x = message.x; hit.y = message.y;
long row = OS.SendMessage(table.handle, OS.LVM_SUBITEMHITTEST, 0, hit);
System.out.println("HIT point=" + hit.x + "," + hit.y + " result=" + row + " item=" + hit.iItem + " column=" + hit.iSubItem + " flags=" + hit.flags);
if (row != 0 || hit.iItem != 0) throw new AssertionError("Expected actual first-row hit");
return hit;
}
/** Invoke the table's actual native notification path, with no hit-test hook. */
private static void notify(Table table) {
NMTTDISPINFO info = new NMTTDISPINFO();
info.hwndFrom = OS.SendMessage(table.handle, OS.LVM_GETTOOLTIPS, 0, 0);
info.code = OS.TTN_GETDISPINFO;
long memory = OS.HeapAlloc(OS.GetProcessHeap(), OS.HEAP_ZERO_MEMORY, NMTTDISPINFO.sizeof);
if (memory == 0) throw new AssertionError("Notification allocation failed");
try {
OS.MoveMemory(memory, info, NMTTDISPINFO.sizeof);
OS.SendMessage(table.handle, OS.WM_NOTIFY, 0, memory);
} finally { OS.HeapFree(OS.GetProcessHeap(), 0, memory); }
}
/** Verify failure, localized tooltip suppression, restoration and valid hits. */
public static void main(String[] args) {
Display display = new Display();
Shell shell = new Shell(display);
Font font = new Font(display, "Segoe UI", 10, SWT.BOLD);
try {
shell.setSize(800, 400);
Table table = new Table(shell, SWT.MULTI | SWT.FULL_SELECTION | SWT.NO_SCROLL);
table.setBounds(0, 0, 600, 250);
table.setHeaderVisible(true);
for (int i = 0; i < 22; i++) {
TableColumn column = new TableColumn(table, SWT.NONE);
column.setText("Column " + i);
column.setWidth(80);
column.setToolTipText("Header tooltip " + i);
}
TableItem item = new TableItem(table, SWT.NONE);
item.setText(0, "Search row");
for (int i = 0; i < 22; i++) item.setFont(i, font);
int y = table.getHeaderHeight() + table.getItemHeight() / 2;
for (boolean suppress : new boolean[] { false, true, false }) {
table.setToolTipText(suppress ? "" : null);
LVHITTESTINFO hit = position(shell, table, -10, y);
if (hit.iSubItem != -1) throw new AssertionError("Expected actual negative column");
try {
notify(table);
if (!suppress) throw new AssertionError("Expected original tooltip exception");
if (!"Header tooltip 0".equals(table.getColumn(0).getToolTipText())) throw new AssertionError("Header tooltip changed");
System.out.println("PASS suppressed native cell tooltip; header tooltip retained");
} catch (ArrayIndexOutOfBoundsException e) {
if (suppress || !e.getStackTrace()[0].getMethodName().equals("fontHandle")) throw e;
System.out.println("PASS baseline actual native failure: " + e);
for (int i = 0; i < Math.min(9, e.getStackTrace().length); i++) System.out.println(" at " + e.getStackTrace()[i]);
}
}
LVHITTESTINFO valid = position(shell, table, 10, y);
if (valid.iSubItem != 0) throw new AssertionError("Valid cell missing");
notify(table);
System.out.println("PASS valid in-table native cell notification");
} finally { shell.dispose(); font.dispose(); display.dispose(); }
}
}Expected behavior
An off-table hit should be rejected without accessing a cell font or throwing an event-loop exception. Valid cell tooltips should continue to work. Please consider checking the subitem bounds before acquiring the device context in Table.positionTooltip(), with defensive bounds handling in TableItem.fontHandle() as appropriate.
Environment
- Windows 11, version 10.0.26300, x86_64.
- Java 21.0.12.
- Win32 SWT
3.135.0.v20260819-1952, used by the tested Trace Compass 12.1 environment. - Linux and macOS were not tested for this defect. A display-scaling cause has not been established.
Version since
Confirmed with the bundle above. The first affected version is unknown.
Workaround / additional context
table.setToolTipText("") avoids the native cell-tooltip path in the standalone reproducer and in the actual TMF Events table; restoring null reproduces the exception again. The tradeoff is losing the table's default cell-text popups. Header-tooltip values and custom hover-listener identities remain intact; their visual popup behavior was not verified by these diagnostics.
The native TMF diagnostic passed one JUnit test, with zero failures/errors/skips and JVM exit 0. The original failure had a 22-element font array, matching the Events table's per-cell-font search row. Other column counts may also be affected; 22 is the tested case.
Activity