[scintilla:bugs] #2481 Crash inside Editor::Paint()

0 views
Skip to first unread message

Zufu Liu

unread,
May 27, 2025, 8:58:57 AMMay 27
to scintill...@googlegroups.com

[bugs:#2481] Crash inside Editor::Paint()

Status: open
Group: Bug
Labels: Scintilla folding crash
Created: Tue May 27, 2025 12:58 PM UTC by Zufu Liu
Last Updated: Tue May 27, 2025 12:58 PM UTC
Owner: Neil Hodgson

I have got a crash inside Editor::Paint() on the line if (!marginView.pixmapSelPattern->Initialised()), where marginView.pixmapSelPattern is nullptr (due to ChangeSize() been called).

Rough call trace (missing quote for multiline string, which cause code folding for all subsequence lines changed):

Paint 000001EF1FBA1B00
Paint marginView 000001EF1FBA1B00
Paint 000001EF1FBA1B00
Paint marginView 000001EF1FBA1B00
FoldExpand
SetScrollBars
Paint 000001EF1FBA1B00
FoldExpand
SetScrollBars
ChangeSize
DropGraphics
SetScrollBars
FoldChanged
SetScrollBars
FoldChanged
... // many repeated FoldChanged / SetScrollBars
FoldChanged
SetScrollBars
FoldChanged
SetScrollBars
Paint marginView 0000000000000000

The crash could be fixed with either:
1. Add extra check: if (!marginView.pixmapSelPattern || !marginView.pixmapSelPattern->Initialised()).
2. Just remove all preceding RefreshPixMaps(surfaceWindow); and add one before the if block (so only a single call). I don't understand why RefreshPixMaps() needs to be called earlier in the function.

Sent from sourceforge.net because scintill...@googlegroups.com is subscribed to https://sourceforge.net/p/scintilla/bugs/

To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/scintilla/admin/bugs/options. Or, if this is a mailing list, you can unsubscribe from the mailing list.

Neil Hodgson

unread,
May 27, 2025, 8:52:32 PMMay 27
to scintill...@googlegroups.com
  1. OK. [7915af]

Zufu Liu

unread,
May 28, 2025, 6:24:50 AMMay 28
to scintill...@googlegroups.com
  • status: open --> open-fixed
  • Comment:

The crash is due to styling inside StyleAreaBounded().

Paint before StyleAreaBounded 00000223964009A0
StyleAreaBounded scrolling=0, area=5723, max=5723
StyleToPositionInView pos=5723, endWindow=5723, endStyled=295
FoldChanged 18
FoldExpand 18, expanding=1
FoldExpand 85 SetScrollBars
SetScrollBars
ChangeSize
DropGraphics
SetScrollBars
FoldChanged 19
FoldChanged 19 SetVisible
SetScrollBars
FoldChanged 20
FoldChanged 20 SetVisible
...
FoldChanged 214
FoldChanged 215
FoldChanged 216
Paint after StyleAreaBounded 0000000000000000
WrapLines(1) lineToWrap=0, lineToWrapEnd=54
WrapLines(1) wrapOccurred=0
Paint marginView Initialised 0000000000000000

styling inside WrapLines(WrapScope::wsVisible) may also cause code folding/scrollbar changes that may (?) not be observed by wrapOccurred, so move down RefreshPixMaps(surfaceWindow); looks is the proper fix.

[bugs:#2481] Crash inside Editor::Paint()

Status: open-fixed


Group: Bug
Labels: Scintilla folding crash
Created: Tue May 27, 2025 12:58 PM UTC by Zufu Liu

Last Updated: Wed May 28, 2025 12:52 AM UTC
Owner: Neil Hodgson

Neil Hodgson

unread,
Jun 8, 2025, 1:24:25 AMJun 8
to scintill...@googlegroups.com
  • status: open-fixed --> closed-fixed

[bugs:#2481] Crash inside Editor::Paint()

Status: closed-fixed


Group: Bug
Labels: Scintilla folding crash
Created: Tue May 27, 2025 12:58 PM UTC by Zufu Liu

Last Updated: Wed May 28, 2025 10:24 AM UTC
Owner: Neil Hodgson

Reply all
Reply to author
Forward
0 new messages