Bug 146267 - [GTK] Crash performing drag-and-drop
Summary: [GTK] Crash performing drag-and-drop
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKitGTK (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Linux
: P2 Normal
Assignee: Michael Catanzaro
Depends on: 146647
  Show dependency treegraph
Reported: 2015-06-23 17:33 PDT by Michael Catanzaro
Modified: 2015-07-06 10:57 PDT (History)
2 users (show)

See Also:

backtrace (45.23 KB, text/plain)
2015-06-23 17:33 PDT, Michael Catanzaro
no flags Details
Patch (1.86 KB, patch)
2015-06-23 17:39 PDT, Michael Catanzaro
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Catanzaro 2015-06-23 17:33:20 PDT
Created attachment 255454 [details]

Try to drag and drop anything from the web view with GTK+ 3.17.2 or higher. The UI process will crash with the attached backtrace.

The problem is in WebKit::DragAndDropHandler::startDrag:

GUniquePtr<GdkEvent> currentEvent(gtk_get_current_event());

GdkDragContext* context = gtk_drag_begin(m_page.viewWidget(), targetList.get(), dragOperationToGdkDragActions(dragData.draggingSourceOperationMask()),
    GDK_BUTTON_PRIMARY, currentEvent.get());

gtk_get_current_event is nullable but the last parameter to gtk_drag_begin is not, so we should check to ensure it is not null here. This of course does not fix drag and drop, but it does fix the crash. Without this, the web process could force the UI process to crash by sending fake startDrag messages.
Comment 1 Michael Catanzaro 2015-06-23 17:39:44 PDT
Created attachment 255455 [details]
Comment 2 WebKit Commit Bot 2015-06-23 19:05:27 PDT
Comment on attachment 255455 [details]

Clearing flags on attachment: 255455

Committed r185896: <http://trac.webkit.org/changeset/185896>
Comment 3 WebKit Commit Bot 2015-06-23 19:05:30 PDT
All reviewed patches have been landed.  Closing bug.
Comment 4 WebKit Commit Bot 2015-07-06 10:56:21 PDT
Re-opened since this is blocked by bug 146647