Repository: electron/electron (language: cpp)

Issue:
[Bug]: Window alert()/prompt() dialog titles corrupted
### Preflight Checklist

- [X] I have read the [Contributing Guidelines](https://github.com/electron/electron/blob/master/CONTRIBUTING.md) for this project.
- [X] I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/master/CODE_OF_CONDUCT.md) that this project adheres to.
- [X] I have searched the [issue tracker](https://www.github.com/electron/electron/issues) for a feature request that matches the one I want to file, without success.

### Electron Version

13.1.6

### What operating system are you using?

Windows

### Operating System Version

Windows 10

### What arch are you using?

ia32

### Last Known Working Electron version

12.0.15

### Expected Behavior

Window alert() and prompt() dialogs titles should be name field specified in package.json

### Actual Behavior

The first 4 characters of the title are always randomised as seen in image below.

![image](https://user-images.githubusercontent.com/32398564/126480681-98849394-355f-40df-a90b-58a2355fbd99.png)


### Testcase Gist URL

https://gist.github.com/CiaranCarroll1/c4e9fdc2db23a649c7f506dc9ac9b411

### Additional Information

_No response_


Discussion / hints:
Thanks for reporting this and helping to make Electron better!

Because of time constraints, triaging code with third-party dependencies is usually not feasible for a small team like Electron's.

Would it be possible for you to make a standalone testcase with only the code necessary to reproduce the issue? For example, [Electron Fiddle](https://www.electronjs.org/fiddle) is a great tool for making small test cases and makes it easy to publish your test case to a [gist](https://gist.github.com) that Electron maintainers can use.

Stand-alone test cases make fixing issues go more smoothly: it ensure everyone's looking at the same issue, it removes all unnecessary variables from the equation, and it can also provide the basis for automated regression tests.

I'm adding the `blocked/need-repro` label for this reason. After you make a test case, please link to it in a followup comment. This issue will be closed in 10 days if the above is not addressed.
No problem, please see gist link below

https://gist.github.com/CiaranCarroll1/c4e9fdc2db23a649c7f506dc9ac9b411
@CiaranCarroll1 do i need to set any other settings? I can't reproduce the issue with the attached gist:

<img width="848" alt="Screen Shot 2021-07-22 at 2 19 51 PM" src="https://user-images.githubusercontent.com/2036040/126638018-828117d6-ce6b-4610-b539-170daaae13a3.png">

![image](https://user-images.githubusercontent.com/32398564/126639426-9190111f-8fac-4657-8562-1c6e9bf2e409.png)

I saw that occasionally too but mostly I saw the above. Seems like the application just isn't loading the name before the alert is called.
I added a 1 second timeout before the alert, hopefully this will allow for the title being loaded before window.alert is called
@codebytere I tried running the app with npm i && npm start and I was seeing "electron.exe" as the title each time. I then packaged the app using the electron packager and ran the exe and I was seeing the title above with the weird characters at the start. Does electron fiddle package before running or place the src into a packaged app? And is there a setting to run it differently which you may have selected? Just trying to figure out why I'm seeing it on fiddle and you're not
Just wanted to mention that this is still an issue on electron 13.3.4 (see https://github.com/electron/electron/issues/31030).  It additionally happens with `dialog.showMessageBox` (see gist in the other issue).

As a workaround - if you switch to using `dialog.showMessageBox` and explicitly pass in a `title`, it should display properly.
Isn't this a potential security issue? It seems like Electron is dereferencing an invalid pointer and showing data from a random memory location on the screen. I'm not sure how this can be exploited, but if Electron is dereferencing invalid pointers, that's something that should be fixed.

(I'm also encountering the dialog.showMessageBox() issue)
Hmm - still can't even with the new timeout 🤔

<img width="829" alt="Screen Shot 2021-10-28 at 7 45 21 PM" src="https://user-images.githubusercontent.com/2036040/139308000-21ec57a4-6a41-4e9f-b9ba-53a421e60d5c.png">


It might have something to do with the "name" field in package.json. I tried setting up a small code sample that triggers the error on 32-bit x86. When the "name" field is short, then everything is fine. When it's missing or long, then the error shows up. Or that could be purely coincidence.
Same issue on 16.0.0.

Fix patch:
diff --git a/shell/browser/ui/message_box_win.cc b/shell/browser/ui/message_box_win.cc
index 31484724d013d..724228e010189 100644
--- a/shell/browser/ui/message_box_win.cc
+++ b/shell/browser/ui/message_box_win.cc
@@ -171,8 +171,9 @@ DialogResult ShowTaskDialogWstr(NativeWindow* parent,
 
   // TaskDialogIndirect doesn't allow empty name, if we set empty title it
   // will show "electron.exe" in title.
+  std::wstring app_name;
   if (title.empty()) {
-    std::wstring app_name = base::UTF8ToWide(Browser::Get()->GetName());
+    app_name = base::UTF8ToWide(Browser::Get()->GetName());
     config.pszWindowTitle = app_name.c_str();
   } else {
     config.pszWindowTitle = base::as_wcstr(title);


Test patch: