Bug 146267

Summary: [GTK] Crash performing drag-and-drop
Product: WebKit Reporter: Michael Catanzaro <mcatanzaro>
Component: WebKitGTKAssignee: Michael Catanzaro <mcatanzaro>
Status: RESOLVED INVALID    
Severity: Normal CC: commit-queue, mcatanzaro
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Linux   
See Also: https://bugzilla.gnome.org/show_bug.cgi?id=751401
Bug Depends on: 146647    
Bug Blocks:    
Attachments:
Description Flags
backtrace
none
Patch none

Description Michael Catanzaro 2015-06-23 17:33:20 PDT
Created attachment 255454 [details]
backtrace

Try to drag and drop anything from the web view with GTK+ 3.17.2 or higher. The UI process will crash with the attached backtrace.

The problem is in WebKit::DragAndDropHandler::startDrag:

GUniquePtr<GdkEvent> currentEvent(gtk_get_current_event());

GdkDragContext* context = gtk_drag_begin(m_page.viewWidget(), targetList.get(), dragOperationToGdkDragActions(dragData.draggingSourceOperationMask()),
    GDK_BUTTON_PRIMARY, currentEvent.get());

gtk_get_current_event is nullable but the last parameter to gtk_drag_begin is not, so we should check to ensure it is not null here. This of course does not fix drag and drop, but it does fix the crash. Without this, the web process could force the UI process to crash by sending fake startDrag messages.
Comment 1 Michael Catanzaro 2015-06-23 17:39:44 PDT
Created attachment 255455 [details]
Patch
Comment 2 WebKit Commit Bot 2015-06-23 19:05:27 PDT
Comment on attachment 255455 [details]
Patch

Clearing flags on attachment: 255455

Committed r185896: <http://trac.webkit.org/changeset/185896>
Comment 3 WebKit Commit Bot 2015-06-23 19:05:30 PDT
All reviewed patches have been landed.  Closing bug.
Comment 4 WebKit Commit Bot 2015-07-06 10:56:21 PDT
Re-opened since this is blocked by bug 146647