Notepad++ crash 'Find in files'-dialog - WebEdit-plugin active

[CoRrRan]

Problem description

When running 'Find all' from the 'Find in files' dialog, while having the 'WebEdit'-plugin v2.9 active, my Notepad++ instance crashes and closes.

NP++ debug info

Notepad++ v8.9 (64-bit)
Build time: Dec 27 2025 - 14:28:33
Scintilla/Lexilla included: 5.5.8/5.4.6
Boost Regex included: 1_85
TinyXML-2 included: 11.0.0
nlohmann JSON included: 3.12.0
Path: C:\Program Files\Notepad++\notepad++.exe
Command Line:
Admin mode: OFF
Local Conf mode: OFF
Cloud Config: OFF
Periodic Backup: ON
Placeholders: OFF
Scintilla Rendering Mode: SC_TECHNOLOGY_DIRECTWRITE (1)
Multi-instance Mode: monoInst
asNotepad: OFF
File Status Auto-Detection: cdEnabledNew (for current file/tab only)
Dark Mode: OFF
Display Info:
primary monitor: 1920x1080, scaling 100%
visible monitors count: 2
installed Display Class adapters:
0000: Description - NVIDIA RTX 3500 Ada Generation Laptop GPU
0000: DriverVersion - 32.0.15.7344
0001: Description - Intel(R) UHD Graphics
0001: DriverVersion - 32.0.101.7077
OS Name: Windows 11 Enterprise (64-bit)
OS Version: 25H2
OS Build: 26200.7462
Current ANSI codepage: 1252
Plugins:
CodeAlignmentNpp (14.1.107)
ColumnTools (1.4.5.1)
ComparePlus (1.2)
HexEditor (0.9.12)
JsonTools (8.4)
mimeTools (3.1)
nppAutoDetectIndent (2.3)
NppConverter (4.7)
NppExport (0.4)
NPPJSONViewer (2.1.1)

Event viewer info

Faulting application name: notepad++.exe, version: 8.9.0.0, time stamp: 0x694fdf3d
Faulting module name: WebEdit.dll, version: 2.9.0.0, time stamp: 0x6911ccfa
Exception code: 0xc0000409
Fault offset: 0x00000000000c0e88
Faulting process id: 0xA54
Faulting application start time: 0x1DC807F8A241A03
Faulting application path: C:\Program Files\Notepad++\notepad++.exe
Faulting module path: C:\Program Files\Notepad++\plugins\WebEdit\WebEdit.dll
Report Id: 5e761b98-efaf-47dc-b347-cb29d27d7cba
Faulting package full name:
Faulting package-relative application ID:

[rdipardo]

This is reproducible, but not like the description says.

To reliably cause the crash:

• click the "Replace" tab in the finder dialog, or press Ctrl+H to open the dialog in replace mode
• make sure the "Find what" string is actually present in the document
• click "Replace All in All Opened Documents" (clicking "Replace All" does not cause the crash)

This was not easy to debug but I think I've identified the problem.

The editor's FindReplaceDlg::processAll function sends an internal message that, when handled, notifies every plugin with the NPPN_GLOBALMODIFIED message. The handler sets the hwndFrom field to the address of the current buffer (stored in the WPARAM by FindReplaceDlg::processAll); WebEdit then tries to compare the buffer address with the current Scintilla handle:

WebEdit/WebEdit/Main.cs

Lines 75 to 76 in 871c332

	// Handle Scintilla notifications (auto-completion)
	if (notification.Header.HwndFrom == Utils.GetCurrentScintilla())

The crash happens during the call to GetCurrentScintilla(). Removing the call here and at line 79 resolves the crash.

Suspecting a deeper issue with how GetCurrentScintilla() was implemented, I rebuilt the plugin after changing the out parameter to IntPtr, and it resolved the crash without changing any of WebEdit's code.

Apparently NPPM_GETCURRENTSCINTILLA actually can return an index of -1, despite a comment in the code saying this "cannot happen". The right circumstances are put in place by the Notepad_plus::replaceInOpenedFiles() function assigning the address of _invisibleEditView to the globally visible _pEditView member. When plugins receive the NPPN_GLOBALMODIFIED message, _pEditView is still pointing to _invisibleEditView, which doesn't match the address of _mainEditView or _subEditView. Calling NPPM_GETCURRENTSCINTILLA at precisely this moment returns a negative index, and, in our case, a stack buffer overrun.

@Krazal, I will push a patched template to NuGet so you can close this issue once you upgrade the package reference and rebuild.

I would still suggest not calling GetCurrentScintilla() so eagerly in the notification handler, however. A simple else will do, since the individual cases will be skipped if the handle does not belong to Scintilla anyway. The scope of the scintillaGateway instance created in line 79 can also be limited to the case where it's actually used.

[Krazal]

@rdipardo Thanks for the troubleshooting! I managed to fix the crash and also optimize the usage of GetCurrentScintilla() a bit.

@CoRrRan "Unfortunately", the latest v8.9.1 update for Notepad++ was released last week, so I don't know when the hotfix will be included in the updates. In any case, you can perform a manual update by downloading the latest release (direct link: v2.9.0.1 [x64]) and overwriting the following file (default path; creating a backup is recommended):

C:\Program Files\Notepad++\plugins\WebEdit\WebEdit.dll

---

OFF: I'm thinking about some more useful updates, e.g. auto. handling of \r, \n and \r\n line breaks, etc. In addition, there used to be a NotepadSharp plugin (not to be confused with the text editor of the same name!), which had a lot of useful functions (e.g. insertion with indentation, closing an open element), but unfortunately it was also quite buggy, and many of its features have since been included in Notepad++ by default. One day, I hope, I'll have the opportunity to supplement WebEdit with such features that can be used for "web editing". 🤞