Name: sg39081 Date: 03/09/99


The implementation for the AwtList::SetMultiSelect() routine found in awt_List.cpp has a bug in that it fails to remove the "this property" before calling DestroyHWnd(). The property was set previously by the AwtComponent::LinkObjects() routine in awt_Component.cpp. By failing to remove the property before destroying the window, the window destruction handling on Windows 95 will delete the global atom used to identify the property. On Windows NT, I do not see the atom getting deleted.

It appears that for some time period, winawt.dll is able to set and retrieve the desired property using the deleted atom. However, under circumstances not totally identified, the property can get corrupted for a particular component and winawt.dll is likely to crash after that. In our instance, the property was being corrupted during a drag-and-drop operation. It is unclear how one might cause an actual crash outside our application.

Though is might be difficult to come up with a simple test case to cause a crash, there is a simple way to see the deletion of the atom. In AwtToolkit::WndProc() found in awt_Toolkit.cpp, add the following lines after the call to ::DestroyWindow executed for the WM_AWT_DESTROY_WINDOW case:

char cBuf[40];
if (GlobalGetAtomName(thisPropertyAtom,cBuf,40) == 0)
DebugBreak();

On Windows 95, if find that the DebugBreak() will be hit if AwtList::SetMultiSelect() is invoked. I do not see the DebugBreak() hit on Windows NT.
(Review ID: 55259)
======================================================================