190787 2018-10-22 00:17:18 -0700 [GTK] Crash while doing drag and drop 2020-11-06 09:11:41 -0800 1 1 1 Unclassified WebKit WebKitGTK WebKit Nightly Build Unspecified Unspecified RESOLVED WORKSFORME https://bugzilla.redhat.com/show_bug.cgi?id=1641396 https://bugzilla.redhat.com/show_bug.cgi?id=1166599 https://bugs.webkit.org/show_bug.cgi?id=217482 P2 Normal --- 1 tpopela webkit-unassigned bugs-noreply mcatanzaro oldest_to_newest 1471182 0 tpopela 2018-10-22 00:17:18 -0700 Reported in downstream in 2.22.0 - https://bugzilla.redhat.com/show_bug.cgi?id=1641396. But what's even more interesting is that the same crash was reported in past against 2.6 as well in https://bugzilla.redhat.com/show_bug.cgi?id=1166599 #0 WebKit::ShareableBitmap::isBackedBySharedMemory (this=0x0) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/Shared/ShareableBitmap.h:109 No locals. #1 WebKit::ShareableBitmap::data (this=this@entry=0x0) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/Shared/ShareableBitmap.cpp:170 No locals. #2 0x00007f8fe9e38876 in WebKit::ShareableBitmap::createCairoSurface (this=0x0) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/Shared/cairo/ShareableBitmapCairo.cpp:85 image = {static isRefPtr = <optimized out>, m_ptr = 0x0} dataKey = {unused = 0} #3 0x00007f8fe9e388f0 in WebKit::ShareableBitmap::createGraphicsContext (this=<optimized out>) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/Shared/cairo/ShareableBitmapCairo.cpp:61 image = {static isRefPtr = <optimized out>, m_ptr = 0x0} bitmapContext = <optimized out> #4 0x00007f8fea134886 in WebKit::convertCairoSurfaceToShareableBitmap (surface=0x55f87d0de270) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/WebProcess/WebCoreSupport/gtk/WebDragClientGtk.cpp:54 imageSize = {m_width = 200, m_height = 0} bitmap = {static isRefPtr = <optimized out>, m_ptr = 0x0} graphicsContext = {_M_t = {_M_t = {<std::_Tuple_impl<0, WebCore::GraphicsContext*, std::default_delete<WebCore::GraphicsContext> >> = {<std::_Tuple_impl<1, std::default_delete<WebCore::GraphicsContext> >> = {<std::_Head_base<1, std::default_delete<WebCore::GraphicsContext>, true>> = {<std::default_delete<WebCore::GraphicsContext>> = {<No data fields>}, <No data fields>}, <No data fields>}, <std::_Head_base<0, WebCore::GraphicsContext*, false>> = {_M_head_impl = 0x1}, <No data fields>}, <No data fields>}}} state = <optimized out> imageSize = <optimized out> bitmap = <optimized out> graphicsContext = <optimized out> state = <optimized out> #5 WebKit::WebDragClient::startDrag (this=0x55f87cb29c00, item=..., dataTransfer=...) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/WebProcess/WebCoreSupport/gtk/WebDragClientGtk.cpp:69 dragImage = <optimized out> bitmap = <optimized out> handle = {m_handle = {m_attachment = {m_type = IPC::Attachment::Uninitialized, m_fileDescriptor = 200, m_size = 0}}, m_size = {m_width = 1090519040, m_height = 1115160576}, m_configuration = {isOpaque = false}} selection = {selectionData = {static isRef = <optimized out>, m_ptr = 0xca000004b0}} #6 0x00007f8feadf821f in WebCore::DragController::doSystemDrag (this=this@entry=0x7f8fc70f72d0, image=..., dragLoc=..., eventPos=..., frame=..., state=..., promisedBlob=...) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebCore/page/DragController.cpp:1266 frameProtector = {static isRef = <optimized out>, m_ptr = 0x7f8f58a4b900} viewProtector = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f61a02600} item = {image = {m_dragImageRef = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_indicatorData = {<std::optional_base<WebCore::TextIndicatorData>> = {init_ = false, storage_ = {dummy_ = 0 '\000', value_ = {selectionRectInRootViewCoordinates = {m_location = {m_x = 0, m_y = 0}, m_size = {m_width = 0.766094208, m_height = 4.59163468e-41}}, textBoundingRectInRootViewCoordinates = {m_location = {m_x = 1.07387699e+09, m_y = 4.57594014e-41}, m_size = {m_width = -1.65900553e+26, m_height = 4.57594014e-41}}, contentImageWithoutSelectionRectInRootViewCoordinates = {m_location = {m_x = 0.766031742, m_y = 4.59163468e-41}, m_size = {m_width = 0, m_height = 4.57594014e-41}}, textRectsInBoundingRectCoordinates = {<WTF::VectorBuffer<WebCore::FloatRect, 0>> = {<WTF::VectorBufferBase<WebCore::FloatRect>> = {m_buffer = 0x0, m_capacity = 3964258072, m_size = 32655}, <No data fields>}, <No data fields>}, contentImageScaleFactor = 53018624, contentImageWithHighlight = {static isRefPtr = <optimized out>, m_ptr = 0x5c000}, contentImageWithoutSelection = {static isRefPtr = <optimized out>, m_ptr = 0x20000000200}, contentImage = {static isRefPtr = <optimized out>, m_ptr = 0x20000000200}, estimatedBackgroundColor = {static black = 4278190080, static white = 4294967295, static darkGray = 4286611584, static gray = 4288716960, static lightGray = 4290822336, static transparent = 0, static cyan = 4278255615, static yellow = 4294967040, static compositionFill = 4292992341, static extendedColor = 0, static invalidRGBAColor = 1, static validRGBAColorBit = 2, static validRGBAColor = 3, static isSemanticRBGAColorBit = 4, static deletedHashValue = 18446744073709551613, static emptyHashValue = 18446744073709551611, m_colorData = {rgbaAndFlags = 1, extendedColor = 0x1}}, presentationTransition = -126, options = 59578}}}, <No data fields>}}, imageAnchorPoint = {m_x = 0, m_y = 0}, sourceAction = WebCore::DragSourceActionImage, eventPositionInContentCoordinates = {m_x = 343, m_y = 72}, dragLocationInContentCoordinates = {m_x = 328, m_y = 72}, dragLocationInWindowCoordinates = {m_x = 328, m_y = 72}, title = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x0}}, url = {m_string = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x0}}, m_isValid = 0, m_protocolIsInHTTPFamily = 0, m_cannotBeABaseURL = 0, m_portLength = 0, static maxPortLength = 7, static maxSchemeLength = 67108863, m_schemeEnd = 0, m_userStart = 0, m_userEnd = 0, m_passwordEnd = 0, m_hostEnd = 0, m_pathAfterLastSlash = 0, m_pathEnd = 0, m_queryEnd = 0}, dragPreviewFrameInRootViewCoordinates = {m_location = {m_x = 8, m_y = 62}, m_size = {m_width = 4152, m_height = 17}}, data = {m_plainText = {<std::optional_base<WebCore::PasteboardWriterData::PlainText>> = {init_ = false, storage_ = {dummy_ = 0 '\000', value_ = {canSmartCopyOrDelete = false, text = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x7f8fe4a905ae <_cairo_pattern_is_clear+270>}}}}}, <No data fields>}, m_url = {<std::optional_base<WebCore::PasteboardWriterData::URL>> = {init_ = false, storage_ = {dummy_ = 0 '\000', value_ = {url = {m_string = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x0}}, m_isValid = 0, m_protocolIsInHTTPFamily = 0, m_cannotBeABaseURL = 0, m_portLength = 0, static maxPortLength = 7, static maxSchemeLength = 67108863, m_schemeEnd = 0, m_userStart = 0, m_userEnd = 0, m_passwordEnd = 1072693248, m_hostEnd = 1061428192, m_pathAfterLastSlash = 4294934527, m_pathEnd = 0, m_queryEnd = 0}, title = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x7f8fe4b1b3e0 <__cairo_clip_all>}}, markup = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0xe7d48aabfbe05300}}}}}, <No data fields>}, m_webContent = {<std::optional_base<WebCore::PasteboardWriterData::WebContent>> = {init_ = false, storage_ = {dummy_ = 0 '\000', value_ = {<No data fields>}}}, <No data fields>}}, promisedBlob = {blobURL = {m_string = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x0}}, m_isValid = 0, m_protocolIsInHTTPFamily = 0, m_cannotBeABaseURL = 0, m_portLength = 0, static maxPortLength = 7, static maxSchemeLength = 67108863, m_schemeEnd = 0, m_userStart = 0, m_userEnd = 0, m_passwordEnd = 0, m_hostEnd = 0, m_pathAfterLastSlash = 0, m_pathEnd = 0, m_queryEnd = 0}, contentType = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x0}}, filename = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x0}}, additionalTypes = {<WTF::VectorBuffer<WTF::String, 0>> = {<WTF::VectorBufferBase<WTF::String>> = {m_buffer = 0x0, m_capacity = 0, m_size = 0}, <No data fields>}, <No data fields>}, additionalData = {<WTF::VectorBuffer<WTF::RefPtr<WebCore::SharedBuffer, WTF::DumbPtrTraits<WebCore::SharedBuffer> >, 0>> = {<WTF::VectorBufferBase<WTF::RefPtr<WebCore::SharedBuffer, WTF::DumbPtrTraits<WebCore::SharedBuffer> > >> = {m_buffer = 0x0, m_capacity = 0, m_size = 0}, <No data fields>}, <No data fields>}}} eventPositionInRootViewCoordinates = {m_x = 343, m_y = 72} dragLocationInRootViewCoordinates = {m_x = 328, m_y = 72} #7 0x00007f8feadf8f5d in WebCore::DragController::doImageDrag (this=this@entry=0x7f8fc70f72d0, element=..., dragOrigin=..., layoutRect=..., frame=..., dragImageOffset=..., state=...) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebCore/platform/URL.h:58 mouseDownPoint = {m_x = 343, m_y = 72} dragImage = {m_dragImageRef = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_indicatorData = {<std::optional_base<WebCore::TextIndicatorData>> = {init_ = false, storage_ = {dummy_ = 0 '\000', value_ = {selectionRectInRootViewCoordinates = {m_location = {m_x = 0.766082764, m_y = 4.59163468e-41}, m_size = {m_width = -1.84637372e+26, m_height = 4.57594014e-41}}, textBoundingRectInRootViewCoordinates = {m_location = {m_x = 6.15004957e+15, m_y = 4.57594014e-41}, m_size = {m_width = 0, m_height = 0}}, contentImageWithoutSelectionRectInRootViewCoordinates = {m_location = {m_x = 2084, m_y = 70.5}, m_size = {m_width = 8, m_height = 62}}, textRectsInBoundingRectCoordinates = {<WTF::VectorBuffer<WebCore::FloatRect, 0>> = {<WTF::VectorBufferBase<WebCore::FloatRect>> = {m_buffer = 0x4278000045820000, m_capacity = 1166147584, m_size = 1117650944}, <No data fields>}, <No data fields>}, contentImageScaleFactor = 8, contentImageWithHighlight = {static isRefPtr = <optimized out>, m_ptr = 0x0}, contentImageWithoutSelection = {static isRefPtr = <optimized out>, m_ptr = 0x0}, contentImage = {static isRefPtr = <optimized out>, m_ptr = 0x0}, estimatedBackgroundColor = {static black = 4278190080, static white = 4294967295, static darkGray = 4286611584, static gray = 4288716960, static lightGray = 4290822336, static transparent = 0, static cyan = 4278255615, static yellow = 4294967040, static compositionFill = 4292992341, static extendedColor = 0, static invalidRGBAColor = 1, static validRGBAColorBit = 2, static validRGBAColor = 3, static isSemanticRBGAColorBit = 4, static deletedHashValue = 18446744073709551613, static emptyHashValue = 18446744073709551611, m_colorData = {rgbaAndFlags = 1325465856, extendedColor = 0x4f010100}}, presentationTransition = WebCore::TextIndicatorPresentationTransition::None, options = 64480}}}, <No data fields>}} scaledOrigin = <optimized out> orientationDescription = {m_respectOrientation = <optimized out>, m_orientation = WebCore::OriginTopLeft} image = <optimized out> #8 0x00007f8feadfb449 in WebCore::DragController::startDrag (this=0x7f8fc70f72d0, src=..., state=..., srcOp=<optimized out>, dragEvent=..., dragOrigin=..., hasData=WebCore::HasNonDefaultPasteboardData::No) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebCore/page/DragController.cpp:1019 protector = {static isRef = <optimized out>, m_ptr = 0x7f8f58a4b900} hitTestResult = {m_hitTestLocation = {m_point = {m_x = {m_value = 21952}, m_y = {m_value = 4608}}, m_boundingBox = {m_location = {m_x = 343, m_y = 72}, m_size = {m_width = 1, m_height = 1}}, m_transformedPoint = {m_x = 343, m_y = 72}, m_transformedRect = {m_p1 = {m_x = 343, m_y = 72}, m_p2 = {m_x = 344, m_y = 72}, m_p3 = {m_x = 344, m_y = 73}, m_p4 = {m_x = 343, m_y = 73}}, m_isRectBased = false, m_isRectilinear = true}, m_innerNode = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f4f0029a0}, m_innerNonSharedNode = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f4f0029a0}, m_pointInInnerNodeFrame = {m_x = {m_value = 21952}, m_y = {m_value = 4608}}, m_localPoint = {m_x = {m_value = 21440}, m_y = {m_value = 640}}, m_innerURLElement = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_scrollbar = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_isOverWidget = false, m_listBasedTestResult = {_M_t = {_M_t = {<std::_Tuple_impl<0, WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > >*, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > > >> = {<std::_Tuple_impl<1, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > > >> = {<std::_Head_base<1, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > >, true>> = {<std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > >> = {<No data fields>}, <No data fields>}, <No data fields>}, <std::_Head_base<0, WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > >*, false>> = {_M_head_impl = 0x0}, <No data fields>}, <No data fields>}}}} includeShadowDOM = <optimized out> sourceContainsHitNode = <optimized out> linkURL = {m_string = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x0}}, m_isValid = 0, m_protocolIsInHTTPFamily = 0, m_cannotBeABaseURL = 0, m_portLength = 0, static maxPortLength = 7, static maxSchemeLength = 67108863, m_schemeEnd = 0, m_userStart = 0, m_userEnd = 0, m_passwordEnd = 0, m_hostEnd = 0, m_pathAfterLastSlash = 0, m_pathEnd = 0, m_queryEnd = 0} imageURL = {m_string = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f6c1cd000}}, m_isValid = 1, m_protocolIsInHTTPFamily = 0, m_cannotBeABaseURL = 1, m_portLength = 0, static maxPortLength = 7, static maxSchemeLength = 67108863, m_schemeEnd = 4, m_userStart = 5, m_userEnd = 5, m_passwordEnd = 5, m_hostEnd = 5, m_pathAfterLastSlash = 19567, m_pathEnd = 19746, m_queryEnd = 19746} mouseDraggedPoint = {m_x = 349, m_y = 71} dragImage = {m_dragImageRef = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_indicatorData = {<std::optional_base<WebCore::TextIndicatorData>> = {init_ = false, storage_ = {dummy_ = 0 '\000', value_ = {selectionRectInRootViewCoordinates = {m_location = {m_x = 1.15638941e+37, m_y = 3.08397766e-41}, m_size = {m_width = -1.44175582e+20, m_height = 4.57594014e-41}}, textBoundingRectInRootViewCoordinates = {m_location = {m_x = 1.15639144e+37, m_y = 3.08397766e-41}, m_size = {m_width = 1.40129846e-45, m_height = 0}}, contentImageWithoutSelectionRectInRootViewCoordinates = {m_location = {m_x = 1.15639246e+37, m_y = 3.08397766e-41}, m_size = {m_width = -2.32951587e+36, m_height = -2.00739933e+24}}, textRectsInBoundingRectCoordinates = {<WTF::VectorBuffer<WebCore::FloatRect, 0>> = {<WTF::VectorBufferBase<WebCore::FloatRect>> = {m_buffer = 0x7fff3f442290, m_capacity = 1061429904, m_size = 32767}, <No data fields>}, <No data fields>}, contentImageScaleFactor = 0.766153812, contentImageWithHighlight = {static isRefPtr = <optimized out>, m_ptr = 0x55f87d0b3210}, contentImageWithoutSelection = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f58a329d8}, contentImage = {static isRefPtr = <optimized out>, m_ptr = 0x7f8fea021852 <WebKit::GObjectEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&)+178>}, estimatedBackgroundColor = {static black = 4278190080, static white = 4294967295, static darkGray = 4286611584, static gray = 4288716960, static lightGray = 4290822336, static transparent = 0, static cyan = 4278255615, static yellow = 4294967040, static compositionFill = 4292992341, static extendedColor = 0, static invalidRGBAColor = 1, static validRGBAColorBit = 2, static validRGBAColor = 3, static isSemanticRBGAColorBit = 4, static deletedHashValue = 18446744073709551613, static emptyHashValue = 18446744073709551611, m_colorData = {rgbaAndFlags = 0, extendedColor = 0x0}}, presentationTransition = WebCore::TextIndicatorPresentationTransition::None, options = 0}}}, <No data fields>}} dragLoc = {m_x = 0, m_y = 0} dragImageOffset = {m_x = 0, m_y = 0} dataTransfer = @0x7f8f59aae930: {<WTF::RefCounted<WebCore::DataTransfer>> = {<WTF::RefCountedBase> = {m_refCount = 1}, <No data fields>}, m_originIdentifier = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x0}}, m_storeMode = WebCore::DataTransfer::StoreMode::Invalid, m_pasteboard = {_M_t = {_M_t = {<std::_Tuple_impl<0, WebCore::Pasteboard*, std::default_delete<WebCore::Pasteboard> >> = {<std::_Tuple_impl<1, std::default_delete<WebCore::Pasteboard> >> = {<std::_Head_base<1, std::default_delete<WebCore::Pasteboard>, true>> = {<std::default_delete<WebCore::Pasteboard>> = {<No data fields>}, <No data fields>}, <No data fields>}, <std::_Head_base<0, WebCore::Pasteboard*, false>> = {_M_head_impl = 0x7f8f59a9f870}, <No data fields>}, <No data fields>}}}, m_itemList = {_M_t = {_M_t = {<std::_Tuple_impl<0, WebCore::DataTransferItemList*, std::default_delete<WebCore::DataTransferItemList> >> = {<std::_Tuple_impl<1, std::default_delete<WebCore::DataTransferItemList> >> = {<std::_Head_base<1, std::default_delete<WebCore::DataTransferItemList>, true>> = {<std::default_delete<WebCore::DataTransferItemList>> = {<No data fields>}, <No data fields>}, <No data fields>}, <std::_Head_base<0, WebCore::DataTransferItemList*, false>> = {_M_head_impl = 0x0}, <No data fields>}, <No data fields>}}}, m_fileList = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_type = WebCore::DataTransfer::Type::DragAndDropData, m_dropEffect = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f59a9f8b8}}, m_effectAllowed = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f59a9f8d0}}, m_shouldUpdateDragImage = true, m_dragLocation = {m_x = 0, m_y = 0}, m_dragImage = {<WebCore::CachedResourceHandleBase> = {m_resource = 0x0}, <No data fields>}, m_dragImageElement = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_dragImageLoader = {_M_t = {_M_t = {<std::_Tuple_impl<0, WebCore::DragImageLoader*, std::default_delete<WebCore::DragImageLoader> >> = {<std::_Tuple_impl<1, std::default_delete<WebCore::DragImageLoader> >> = {<std::_Head_base<1, std::default_delete<WebCore::DragImageLoader>, true>> = {<std::default_delete<WebCore::DragImageLoader>> = {<No data fields>}, <No data fields>}, <No data fields>}, <std::_Head_base<0, WebCore::DragImageLoader*, false>> = {_M_head_impl = 0x0}, <No data fields>}, <No data fields>}}}} element = @0x7f8f4f0029a0: {<WebCore::ContainerNode> = {<WebCore::Node> = {<WebCore::EventTarget> = {<WebCore::ScriptWrappable> = {m_wrapper = {m_impl = 0x0}}, _vptr.EventTarget = 0x7f8fec19a3a0 <vtable for WebCore::HTMLImageElement+16>}, m_refCount = 19, m_nodeFlags = 1058078, m_parentNode = 0x7f8f5b603ba0, m_treeScope = 0x7f8f4c603350, m_previous = 0x0, m_next = 0x0, m_data = {m_renderer = 0x7f8f4fe01700, m_rareData = 0x7f8f4fe01700}}, m_firstChild = 0x0, m_lastChild = 0x0}, m_tagName = {m_impl = {static isRefPtr = <optimized out>, m_ptr = 0x7f8fc7095e10}}, m_elementData = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f58a73420}} mustUseLegacyDragClient = <optimized out> dragImageBounds = <optimized out> image = <optimized out> #9 0x00007f8feadfbdc2 in WebCore::EventHandler::handleDrag (this=0x7f8fc702d240, event=..., checkDragHysteresis=<optimized out>) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebCore/page/MouseEventWithHitTestResults.h:34 page = <optimized out> protectedFrame = {static isRef = <optimized out>, m_ptr = 0x7f8f58a4b900} srcOp = WebCore::DragOperationEvery hasNonDefaultPasteboardData = WebCore::HasNonDefaultPasteboardData::No event = @0x7fff3f4428f0: {m_event = {<WebCore::PlatformEvent> = {m_type = 5, m_modifiers = {m_storage = 0 '\000'}, m_timestamp = {static clockType = WTF::ClockType::Wall, m_value = 1540125218.1370258}}, m_position = {m_x = 349, m_y = 71}, m_globalPosition = {m_x = 387, m_y = 542}, m_button = WebCore::LeftButton, m_buttons = 1, m_clickCount = 0, m_modifierFlags = 0, m_force = 0, m_syntheticClickType = WebCore::NoTap}, m_hitTestResult = {m_hitTestLocation = {m_point = {m_x = {m_value = 22336}, m_y = {m_value = 4544}}, m_boundingBox = {m_location = {m_x = 349, m_y = 71}, m_size = {m_width = 1, m_height = 1}}, m_transformedPoint = {m_x = 349, m_y = 71}, m_transformedRect = {m_p1 = {m_x = 349, m_y = 71}, m_p2 = {m_x = 350, m_y = 71}, m_p3 = {m_x = 350, m_y = 72}, m_p4 = {m_x = 349, m_y = 72}}, m_isRectBased = false, m_isRectilinear = true}, m_innerNode = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f4f0029a0}, m_innerNonSharedNode = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f4f0029a0}, m_pointInInnerNodeFrame = {m_x = {m_value = 22336}, m_y = {m_value = 4544}}, m_localPoint = {m_x = {m_value = 21824}, m_y = {m_value = 576}}, m_innerURLElement = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_scrollbar = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_isOverWidget = false, m_listBasedTestResult = {_M_t = {_M_t = {<std::_Tuple_impl<0, WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > >*, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > > >> = {<std::_Tuple_impl<1, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > > >> = {<std::_Head_base<1, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > >, true>> = {<std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > >> = {<No data fields>}, <No data fields>}, <No data fields>}, <std::_Head_base<0, WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > >*, false>> = {_M_head_impl = 0x0}, <No data fields>}, <No data fields>}}}}} this = 0x7f8fc702d240 protectedFrame = <optimized out> view = <optimized out> dragStartDataTransfer = <optimized out> renderer = <optimized out> delta = <optimized out> srcOp = <optimized out> absolutePosition = <optimized out> page = <optimized out> checkDragHysteresis = <optimized out> hasNonDefaultPasteboardData = <optimized out> request = <optimized out> result = <optimized out> protectedFrame = <optimized out> srcOp = <optimized out> hasNonDefaultPasteboardData = <optimized out> request = <optimized out> result = <optimized out> view = <optimized out> dragStartDataTransfer = <optimized out> renderer = <optimized out> absolutePosition = <optimized out> delta = <optimized out> page = <optimized out> #10 0x00007f8feadfc438 in WebCore::EventHandler::handleMouseDraggedEvent (this=0x7f8fc702d240, event=..., checkDragHysteresis=<optimized out>) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebCore/page/EventHandler.cpp:848 protectedFrame = {static isRef = <optimized out>, m_ptr = 0x7f8f58a4b900} targetNode = <optimized out> renderer = <optimized out> checkDragHysteresis = <optimized out> this = 0x7f8fc702d240 parent = <optimized out> event = @0x7fff3f4428f0: {m_event = {<WebCore::PlatformEvent> = {m_type = 5, m_modifiers = {m_storage = 0 '\000'}, m_timestamp = {static clockType = WTF::ClockType::Wall, m_value = 1540125218.1370258}}, m_position = {m_x = 349, m_y = 71}, m_globalPosition = {m_x = 387, m_y = 542}, m_button = WebCore::LeftButton, m_buttons = 1, m_clickCount = 0, m_modifierFlags = 0, m_force = 0, m_syntheticClickType = WebCore::NoTap}, m_hitTestResult = {m_hitTestLocation = {m_point = {m_x = {m_value = 22336}, m_y = {m_value = 4544}}, m_boundingBox = {m_location = {m_x = 349, m_y = 71}, m_size = {m_width = 1, m_height = 1}}, m_transformedPoint = {m_x = 349, m_y = 71}, m_transformedRect = {m_p1 = {m_x = 349, m_y = 71}, m_p2 = {m_x = 350, m_y = 71}, m_p3 = {m_x = 350, m_y = 72}, m_p4 = {m_x = 349, m_y = 72}}, m_isRectBased = false, m_isRectilinear = true}, m_innerNode = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f4f0029a0}, m_innerNonSharedNode = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f4f0029a0}, m_pointInInnerNodeFrame = {m_x = {m_value = 22336}, m_y = {m_value = 4544}}, m_localPoint = {m_x = {m_value = 21824}, m_y = {m_value = 576}}, m_innerURLElement = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_scrollbar = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_isOverWidget = false, m_listBasedTestResult = {_M_t = {_M_t = {<std::_Tuple_impl<0, WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > >*, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > > >> = {<std::_Tuple_impl<1, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > > >> = {<std::_Head_base<1, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > >, true>> = {<std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > >> = {<No data fields>}, <No data fields>}, <No data fields>}, <std::_Head_base<0, WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > >*, false>> = {_M_head_impl = 0x0}, <No data fields>}, <No data fields>}}}}} protectedFrame = <optimized out> targetNode = <optimized out> renderer = <optimized out> result = <optimized out> protectedFrame = <optimized out> targetNode = <optimized out> renderer = <optimized out> parent = <optimized out> result = <optimized out> #11 0x00007f8feadfcb0f in WebCore::EventHandler::handleMouseMoveEvent (this=0x7f8fc702d240, platformMouseEvent=..., hoveredNode=0x7fff3f442a40, onlyUpdateScrollbars=<optimized out>) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebCore/page/EventHandler.cpp:2003 defaultPrevented = <optimized out> protectedFrame = {static isRef = <optimized out>, m_ptr = 0x7f8f58a4b900} protector = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f61a02600} hitType = <optimized out> request = {m_requestType = 780} mouseEvent = {m_event = {<WebCore::PlatformEvent> = {m_type = 5, m_modifiers = {m_storage = 0 '\000'}, m_timestamp = {static clockType = WTF::ClockType::Wall, m_value = 1540125218.1370258}}, m_position = {m_x = 349, m_y = 71}, m_globalPosition = {m_x = 387, m_y = 542}, m_button = WebCore::LeftButton, m_buttons = 1, m_clickCount = 0, m_modifierFlags = 0, m_force = 0, m_syntheticClickType = WebCore::NoTap}, m_hitTestResult = {m_hitTestLocation = {m_point = {m_x = {m_value = 22336}, m_y = {m_value = 4544}}, m_boundingBox = {m_location = {m_x = 349, m_y = 71}, m_size = {m_width = 1, m_height = 1}}, m_transformedPoint = {m_x = 349, m_y = 71}, m_transformedRect = {m_p1 = {m_x = 349, m_y = 71}, m_p2 = {m_x = 350, m_y = 71}, m_p3 = {m_x = 350, m_y = 72}, m_p4 = {m_x = 349, m_y = 72}}, m_isRectBased = false, m_isRectilinear = true}, m_innerNode = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f4f0029a0}, m_innerNonSharedNode = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f4f0029a0}, m_pointInInnerNodeFrame = {m_x = {m_value = 22336}, m_y = {m_value = 4544}}, m_localPoint = {m_x = {m_value = 21824}, m_y = {m_value = 576}}, m_innerURLElement = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_scrollbar = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_isOverWidget = false, m_listBasedTestResult = {_M_t = {_M_t = {<std::_Tuple_impl<0, WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > >*, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > > >> = {<std::_Tuple_impl<1, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > > >> = {<std::_Head_base<1, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > >, true>> = {<std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > >> = {<No data fields>}, <No data fields>}, <No data fields>}, <std::_Head_base<0, WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > >*, false>> = {_M_head_impl = 0x0}, <No data fields>}, <No data fields>}}}}} swallowEvent = <optimized out> newSubframe = {static isRefPtr = <optimized out>, m_ptr = 0x0} #12 0x00007f8feadfcccd in WebCore::EventHandler::mouseMoved (this=0x7f8fc702d240, event=...) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebCore/page/EventHandler.cpp:1859 protectedFrame = {static isRef = <optimized out>, m_ptr = 0x7f8f58a4b900} protector = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f61a02600} maxDurationTracker = {m_maxDuration = 0x7f8fc70e6000, m_start = {static clockType = WTF::ClockType::Monotonic, m_value = 1027023.316871}} hoveredNode = {m_hitTestLocation = {m_point = {m_x = {m_value = 22336}, m_y = {m_value = 4544}}, m_boundingBox = {m_location = {m_x = 349, m_y = 71}, m_size = {m_width = 1, m_height = 1}}, m_transformedPoint = {m_x = 349, m_y = 71}, m_transformedRect = {m_p1 = {m_x = 349, m_y = 71}, m_p2 = {m_x = 350, m_y = 71}, m_p3 = {m_x = 350, m_y = 72}, m_p4 = {m_x = 349, m_y = 72}}, m_isRectBased = false, m_isRectilinear = true}, m_innerNode = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f4f0029a0}, m_innerNonSharedNode = {static isRefPtr = <optimized out>, m_ptr = 0x7f8f4f0029a0}, m_pointInInnerNodeFrame = {m_x = {m_value = 22336}, m_y = {m_value = 4544}}, m_localPoint = {m_x = {m_value = 21824}, m_y = {m_value = 576}}, m_innerURLElement = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_scrollbar = {static isRefPtr = <optimized out>, m_ptr = 0x0}, m_isOverWidget = false, m_listBasedTestResult = {_M_t = {_M_t = {<std::_Tuple_impl<0, WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > >*, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > > >> = {<std::_Tuple_impl<1, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > > >> = {<std::_Head_base<1, std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > >, true>> = {<std::default_delete<WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > > >> = {<No data fields>}, <No data fields>}, <No data fields>}, <std::_Head_base<0, WTF::ListHashSet<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, WTF::PtrHash<WTF::RefPtr<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> > > >*, false>> = {_M_head_impl = 0x0}, <No data fields>}, <No data fields>}}}} result = <optimized out> page = <optimized out> #13 0x00007f8fea155390 in WebKit::WebPage::mouseEvent (this=this@entry=0x7f8fc4cbbb80, mouseEvent=...) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebCore/page/Page.h:239 userIsInteractingChange = {m_scopedVariable = @0x7f8fc4cbbe98, m_originalValue = false} shouldHandleEvent = true handled = <optimized out> #14 0x00007f8fe9d21067 in IPC::callMemberFunctionImpl<WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&), std::tuple<WebKit::WebMouseEvent>, 0ul> (args=..., function=<optimized out>, object=0x7f8fc4cbbb80) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/x86_64-redhat-linux-gnu/DerivedSources/WebKit/WebPageMessageReceiver.cpp:219 No locals. #15 IPC::callMemberFunction<WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&), std::tuple<WebKit::WebMouseEvent>, std::integer_sequence<unsigned long, 0ul> > (function=<optimized out>, object=0x7f8fc4cbbb80, args=...) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/Platform/IPC/HandleMessage.h:47 No locals. #16 IPC::handleMessage<Messages::WebPage::MouseEvent, WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&)> (function=<optimized out>, object=0x7f8fc4cbbb80, decoder=...) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/Platform/IPC/HandleMessage.h:127 arguments = {<std::_Tuple_impl<0, WebKit::WebMouseEvent>> = {<std::_Head_base<0, WebKit::WebMouseEvent, false>> = {_M_head_impl = {<WebKit::WebEvent> = {m_type = 2, m_modifiers = 0, m_timestamp = {static clockType = WTF::ClockType::Wall, m_value = 1540125218.1370258}}, m_button = 0, m_buttons = 1, m_position = {m_x = 349, m_y = 71}, m_globalPosition = {m_x = 387, m_y = 542}, m_deltaX = 0, m_deltaY = 0, m_deltaZ = 0, m_clickCount = 0, m_force = 0, m_syntheticClickType = 0}}, <No data fields>}, <No data fields>} arguments = <optimized out> #17 WebKit::WebPage::didReceiveWebPageMessage (this=0x7f8fc4cbbb80, connection=..., decoder=...) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/x86_64-redhat-linux-gnu/DerivedSources/WebKit/WebPageMessageReceiver.cpp:219 No locals. #18 0x00007f8fe9dbbf17 in IPC::MessageReceiverMap::dispatchMessage (this=this@entry=0x55f87cb90968, connection=..., decoder=...) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/Platform/IPC/MessageReceiverMap.cpp:123 messageReceiver = <optimized out> #19 0x00007f8fe9feb02a in WebKit::WebProcess::didReceiveMessage (this=0x55f87cb90900, connection=..., decoder=...) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/Shared/ChildProcess.h:78 No locals. #20 0x00007f8fe9db7244 in IPC::Connection::dispatchMessage (this=0x7f8fc70e8000, message=...) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/Platform/IPC/Connection.cpp:984 oldDidReceiveInvalidMessage = false #21 0x00007f8fe9db7c2a in IPC::Connection::dispatchOneIncomingMessage (this=0x7f8fc70e8000) at /usr/src/debug/webkit2gtk3-2.22.0-1.fc28.x86_64/Source/WebKit/Platform/IPC/Connection.cpp:1053 message = {_M_t = {_M_t = {<std::_Tuple_impl<0, IPC::Decoder*, std::default_delete<IPC::Decoder> >> = {<std::_Tuple_impl<1, std::default_delete<IPC::Decoder> >> = {<std::_Head_base<1, std::default_delete<IPC::Decoder>, true>> = {<std::default_delete<IPC::Decoder>> = {<No data fields>}, <No data fields>}, <No data fields>}, <std::_Head_base<0, IPC::Decoder*, false>> = {_M_head_impl = 0x0}, <No data fields>}, <No data fields>}}} #22 0x00007f8fe8b72415 in ?? () No symbol table info available. #23 0x00007fff3f442ea0 in ?? () No symbol table info available. #24 0x0000000000000001 in ?? () No symbol table info available. #25 0xffffffffffffffff in ?? () No symbol table info available. #26 0x000055f87cb46900 in ?? () No symbol table info available. #27 0x000055f87cb93630 in ?? () No symbol table info available. #28 0x00007f8fe1289280 in depth_private () from /lib64/libglib-2.0.so.0 No symbol table info available. #29 0x0000000000000000 in ?? () No symbol table info available. 1705273 1 mcatanzaro 2020-11-06 09:11:41 -0800 I'm going to go ahead and close this, since the dnd code has been completely rewritten for 2.30, and it's unclear whether this particular crash is still possible. There are a couple more dnd fixes going into 2.30.3, so feel free to reopen with a fresh backtrace if you see it again after that.