Ticket #20 (closed defect: fixed)

Opened 3 months ago

Last modified 2 months ago

Crash in Table._getItem

Reported by: torhu Assigned to: keinfarbton
Priority: critical Milestone:
Component: dwt-win Version:
Keywords: Cc: torhu@yahoo.com

Description

Table_.getItem gets handed an invalid index, see bottom of traceback. This bug happens with r254, but does not exist in r211. It could be related to using a PaintItem? listener, my app does that.

Tried both dmd 1.027 and 1.033, tango rev. 3753. 

Unhandled D Exception (tango.core.Exception.ArrayBoundsException
 "Array index out of bounds") at KERNEL32.dll (0x7c812aeb) thread(2540)
->us
#0 ?? () at dwt\widgets\Table.d:198 from KERNEL32.dll
#1 0x0060e520 in __d_throw@4 () at dwt\widgets\Table.d:198 from deh
#2 0x00480f06 in  dwt.widgets.TableItem.TableItem dwt.widgets.Table.Table._getIt
em () at dwt\widgets\Table.d:198
#3 0x00482010 in  dwt.internal.win32.OS.LDWTRESULT dwt.widgets.Table.Table.CDDS_
SUBITEMPOSTPAINT () at dwt\widgets\Table.d:762
#4 0x0048e4f4 in  dwt.internal.win32.OS.LDWTRESULT dwt.widgets.Table.Table.wmNot
ifyChild () at dwt\widgets\Table.d:6450
#5 0x00472f35 in  dwt.internal.win32.OS.LDWTRESULT dwt.widgets.Control.Control.w
mNotify () at dwt\widgets\Control.d:4767
#6 0x0045708a in  dwt.internal.win32.OS.LDWTRESULT dwt.widgets.Composite.Composi
te.wmNotify () at dwt\widgets\Composite.d:1784
#7 0x00472287 in  dwt.internal.win32.OS.LDWTRESULT dwt.widgets.Control.Control.W
M_NOTIFY () at dwt\widgets\Control.d:4397
#8 0x0047104f in  dwt.widgets.Control.Control.windowProc () at dwt\widgets\Contr
ol.d:3892
#9 0x0042f38e in  dwt.widgets.Display.Display.windowProc () at dwt\widgets\Displ
ay.d:4664
#10 0x0042f14c in extern  (lParam = 1242404, wParam = 0x001703ba, msg = 0x000000
4e, hwnd = 0x001603c6) at dwt\widgets\Display.d:4601
#11 0x7e418734 in ?? () at dwt\widgets\Table.d:374 from USER32.dll
#12 0x7e418816 in ?? () at dwt\widgets\Table.d:374 from USER32.dll
#13 0x7e42927b in ?? () at dwt\widgets\Table.d:374 from USER32.dll
#14 0x7e4292e3 in ?? () at dwt\widgets\Table.d:374 from USER32.dll
#15 0x773eb001 in ?? () at dwt\widgets\Table.d:374 from COMCTL32.dll
#16 0x773eb08f in ?? () at dwt\widgets\Table.d:374 from COMCTL32.dll
#17 0x7743cfec in ?? () at dwt\widgets\Table.d:374 from COMCTL32.dll
#18 0x77417f14 in ?? () at dwt\widgets\Table.d:374 from COMCTL32.dll
#19 0x7741dd14 in ?? () at dwt\widgets\Table.d:374 from COMCTL32.dll
#20 0x7741ecba in ?? () at dwt\widgets\Table.d:374 from COMCTL32.dll
#21 0x774215ce in ?? () at dwt\widgets\Table.d:374 from COMCTL32.dll
#22 0x7e418734 in ?? () at dwt\widgets\Table.d:374 from USER32.dll
#23 0x7e418816 in ?? () at dwt\widgets\Table.d:374 from USER32.dll
#24 0x7e42a013 in ?? () at dwt\widgets\Table.d:374 from USER32.dll
#25 0x7e42a039 in ?? () at dwt\widgets\Table.d:374 from USER32.dll
#26 0x00481316 in  dwt.widgets.Table.Table.callWindowProc () at dwt\widgets\Tabl
e.d:374
#27 0x00481024 in  dwt.widgets.Table.Table.callWindowProc () at dwt\widgets\Tabl
e.d:239
#28 0x004713a2 in  dwt.widgets.Control.Control.windowProc () at dwt\widgets\Cont
rol.d:3930
#29 0x0048c301 in  dwt.widgets.Table.Table.windowProc () at dwt\widgets\Table.d:
5520
#30 0x0042f38e in  dwt.widgets.Display.Display.windowProc () at dwt\widgets\Disp
lay.d:4664
#31 0x0042f14c in extern  (lParam = 0, wParam = 0x00000000, msg = 0x0000000f, hw
nd = 0x001703ba) at dwt\widgets\Display.d:4601
#32 0x7e418734 in ?? () at dwt\widgets\Display.d:3526 from USER32.dll
#33 0x7e418816 in ?? () at dwt\widgets\Display.d:3526 from USER32.dll
#34 0x7e428ea0 in ?? () at dwt\widgets\Display.d:3526 from USER32.dll
#35 0x7e428eec in ?? () at dwt\widgets\Display.d:3526 from USER32.dll
#36 0x7c90e453 in ?? () at dwt\widgets\Display.d:3526 from ntdll.dll
#37 0x7e418a10 in ?? () at dwt\widgets\Display.d:3526 from USER32.dll
#38 0x0042c4e5 in  dwt.widgets.Display.Display.readAndDispatch () at dwt\widgets
\Display.d:3526
#39 0x00405411 in  main._main (args = {
  [0] = "MonsterBrowser.exe"
}) at main.d:178
#40 0x00405056 in _Dmain (args = {
  [0] = "MonsterBrowser.exe"
}) at main.d:46
#41 0x0060e338 in extern (C) int dmain2.main(int, char**) . void runMain(void*)
() from dmain2
#42 0x0060e36f in extern (C) int dmain2.main(int, char**) . void runAll(void*) (
) from dmain2
#43 0x0060e0b0 in _main () from dmain2
#44 0x00621d45 in _mainCRTStartup () from constart
#45 0x7c817067 in ?? () from KERNEL32.dll
->f
Current frame level is 2
->lsv
Scope: class dwt.widgets.TableItem.TableItem dwt.widgets.Table.Table._getItem(in
t, void*), parent: 0000
_TMP3926 = 0x01231000
index = 1459686963
this = ...

Attachments

tablebug.d (3.4 kB) - added by Anonymous on 08/04/08 19:52:18.
Test case with virtual table, based on snippet 144
tablebug2.d (2.7 kB) - added by Anonymous on 08/04/08 20:03:32.
Test case with non-virtual table, snippet 38

Change History

08/03/08 23:41:35 changed by Anonymous

It seems likely that this bug was introduced in r213, but I haven't verified that it's not r217 yet. The item index is added somewhere between frame 11 and 25, inclusive, in the stack trace. So I'm not able to see easily in the debugger where it happens.

I'm using r230 when debugging, as r229 fixes another bug introduced in r213 that stops me from getting far enough to see the other bug happening with my app.

My app has got three Tables. Two of them are virtual, and use PaintItem? and MeasureItem? listeners. If I disable those listeners, it does not crash. The crash happens if I click on an item in one of them. If I create the Table object with DWT.FULL_SELECTION, it doesn't crash. Only with DWT.HIDE_SELECTION, or the default selection style does it crash.

I guess the next step would be to replace some of the Table code with code from r211, and see if that fixes it.

But I'll probably be away for two weeks now, starting tomorrow.

08/04/08 19:52:18 changed by Anonymous

  • attachment tablebug.d added.

Test case with virtual table, based on snippet 144

08/04/08 20:03:32 changed by Anonymous

  • attachment tablebug2.d added.

Test case with non-virtual table, snippet 38

08/04/08 21:06:14 changed by keinfarbton

Fixed in -r279:e4b7af6b8e7e

Thanks for the report.

08/04/08 21:06:23 changed by keinfarbton

  • status changed from new to closed.
  • resolution set to fixed.