To reproduce: 1. run-webkit-tests You'll hit this assertion: ASSERT(!down); Here's the backtrace: DumpRenderTree_debug.exe!replaySavedEvents() Line 299 + 0x27 bytes C++ DumpRenderTree_debug.exe!UIDelegate::doDragDrop(IWebView * sender=0x02126990, IDataObject * object=0x049e6bc8, IDropSource * source=0x0486be78, unsigned long okEffect=7, unsigned long * performedEffect=0x0012e328) Line 370 C++ WebKit_debug.dll!WebDragClient::startDrag(HBITMAP__ * image=0x87051537, const WebCore::IntPoint & imageOrigin={...}, const WebCore::IntPoint & dragPoint={...}, WebCore::Clipboard * clipboard=0x0528d2e8, WebCore::Frame * frame=0x0214d068, bool isLink=false) Line 152 + 0x4e bytes C++ WebKit_debug.dll!WebCore::DragController::doSystemDrag(HBITMAP__ * image=0x87051537, const WebCore::IntPoint & dragLoc={...}, const WebCore::IntPoint & eventPos={...}, WebCore::Clipboard * clipboard=0x0528d2e8, WebCore::Frame * frame=0x049b9a08, bool forLink=false) Line 752 + 0x84 bytes C++ WebKit_debug.dll!WebCore::DragController::startDrag(WebCore::Frame * src=0x049b9a08, WebCore::Clipboard * clipboard=0x0528d2e8, WebCore::DragOperation srcOp=DragOperationNone, const WebCore::PlatformMouseEvent & dragEvent={...}, const WebCore::IntPoint & dragOrigin={...}, bool isDHTMLDrag=false) Line 688 C++ WebKit_debug.dll!WebCore::EventHandler::handleDrag(const WebCore::MouseEventWithHitTestResults & event={...}) Line 2055 + 0x44 bytes C++ WebKit_debug.dll!WebCore::EventHandler::handleMouseDraggedEvent(const WebCore::MouseEventWithHitTestResults & event={...}) Line 385 + 0xc bytes C++ WebKit_debug.dll!WebCore::EventHandler::handleMouseMoveEvent(const WebCore::PlatformMouseEvent & mouseEvent={...}, WebCore::HitTestResult * hoveredNode=0x0012e9f0) Line 1241 + 0xc bytes C++ WebKit_debug.dll!WebCore::EventHandler::passMouseMoveEventToSubframe(WebCore::MouseEventWithHitTestResults & mev={...}, WebCore::Frame * subframe=0x049b9a08, WebCore::HitTestResult * hoveredNode=0x0012e9f0) Line 63 C++ WebKit_debug.dll!WebCore::EventHandler::handleMouseMoveEvent(const WebCore::PlatformMouseEvent & mouseEvent={...}, WebCore::HitTestResult * hoveredNode=0x0012e9f0) Line 1226 + 0x23 bytes C++ WebKit_debug.dll!WebCore::EventHandler::mouseMoved(const WebCore::PlatformMouseEvent & event={...}) Line 1142 + 0x10 bytes C++ WebKit_debug.dll!WebView::handleMouseEvent(unsigned int message=512, unsigned int wParam=1, long lParam=5046562) Line 1291 + 0x1d bytes C++ WebKit_debug.dll!WebViewWndProc(HWND__ * hWnd=0x00070912, unsigned int message=512, unsigned int wParam=1, long lParam=5046562) Line 1709 + 0x14 bytes C++ user32.dll!_InternalCallWinProc@20() + 0x28 bytes user32.dll!_UserCallWinProcCheckWow@32() + 0xb7 bytes user32.dll!_CallWindowProcAorW@24() + 0x51 bytes user32.dll!_CallWindowProcW@20() + 0x1b bytes comctl32.dll!_CallOriginalWndProc@24() + 0x1a bytes comctl32.dll!_CallNextSubclassProc@20() + 0x3c bytes comctl32.dll!_DefSubclassProc@16() + 0x46 bytes comctl32.dll!_TTSubclassProc@24() + 0x59 bytes comctl32.dll!_CallNextSubclassProc@20() + 0x3c bytes comctl32.dll!_MasterSubclassProc@16() + 0x41 bytes user32.dll!_InternalCallWinProc@20() + 0x28 bytes user32.dll!_UserCallWinProcCheckWow@32() + 0xb7 bytes user32.dll!_DispatchMessageWorker@8() + 0xdc bytes user32.dll!_DispatchMessageW@4() + 0xf bytes DumpRenderTree_debug.exe!dispatchMessage(const tagMSG * msg=0x0012ef80) Line 128 + 0xc bytes C++ DumpRenderTree_debug.exe!doMouseMove(tagMSG msg={...}) Line 227 + 0x9 bytes C++ DumpRenderTree_debug.exe!mouseMoveToCallback(const OpaqueJSContext * context=0x03ba0168, OpaqueJSValue * function=0x02998060, OpaqueJSValue * thisObject=0x029951c0, unsigned int argumentCount=2, const OpaqueJSValue * const * arguments=0x0012f050, const OpaqueJSValue * * exception=0x021d8874) Line 265 + 0x14 bytes C++ WebKit_debug.dll!JSC::JSCallbackFunction::call(JSC::ExecState * exec=0x03ba0168, JSC::JSObject * functionObject=0x02998060, JSC::JSValuePtr thisValue={...}, const JSC::ArgList & args={...}) Line 61 + 0x35 bytes C++ WebKit_debug.dll!JSC::Machine::cti_op_call_NotJSFunction(void * * args=0x0012f1ac) Line 4766 + 0x3a bytes C++ WebKit_debug.dll!JSC::Machine::cti_op_convert_this() + 0xff bytes C++ WebKit_debug.dll!JSC::Machine::execute(JSC::FunctionBodyNode * functionBodyNode=0x048ec930, JSC::ExecState * callFrame=0x049db7fc, JSC::JSFunction * function=0x029951a0, JSC::JSObject * thisObj=0x02990000, const JSC::ArgList & args={...}, JSC::ScopeChainNode * scopeChain=0x0489f630, JSC::JSValuePtr * exception=0x021d8874) Line 993 + 0x26 bytes C++ WebKit_debug.dll!JSC::JSFunction::call(JSC::ExecState * exec=0x049db7fc, JSC::JSValuePtr thisValue={...}, const JSC::ArgList & args={...}) Line 82 + 0x54 bytes C++ WebKit_debug.dll!JSC::call(JSC::ExecState * exec=0x049db7fc, JSC::JSValuePtr functionObject={...}, JSC::CallType callType=CallTypeJS, const JSC::CallData & callData={...}, JSC::JSValuePtr thisValue={...}, const JSC::ArgList & args={...}) Line 39 + 0x23 bytes C++ WebKit_debug.dll!WebCore::ScheduledAction::execute(WebCore::JSDOMWindowShell * windowShell=0x02990000) Line 74 + 0x3d bytes C++ WebKit_debug.dll!WebCore::JSDOMWindowBase::timerFired(WebCore::DOMWindowTimer * timer=0x022f9820) Line 1056 C++ WebKit_debug.dll!WebCore::DOMWindowTimer::fired() Line 1089 C++ WebKit_debug.dll!WebCore::TimerBase::fireTimers(double fireTime=1224690131.8129337, const WTF::Vector<WebCore::TimerBase *,0> & firingTimers=[3](0x02178268 {m_nextFireTime=??? m_repeatInterval=??? m_heapIndex=??? ...},0x0214d5c8 {m_nextFireTime=??? m_repeatInterval=??? m_heapIndex=??? ...},0x022f9820 {m_nextFireTime=4.940656458412e-324#DEN m_repeatInterval=3.7741764022031736e-298 m_heapIndex=0 ...})) Line 347 + 0xf bytes C++ WebKit_debug.dll!WebCore::TimerBase::sharedTimerFired() Line 368 + 0x12 bytes C++ WebKit_debug.dll!WebCore::TimerWindowWndProc(HWND__ * hWnd=0x00100936, unsigned int message=49536, unsigned int wParam=0, long lParam=0) Line 102 + 0x8 bytes C++ user32.dll!_InternalCallWinProc@20() + 0x28 bytes user32.dll!_UserCallWinProcCheckWow@32() + 0xb7 bytes user32.dll!_DispatchMessageWorker@8() + 0xdc bytes user32.dll!_DispatchMessageW@4() + 0xf bytes > DumpRenderTree_debug.exe!runTest(const char * pathOrURL=0x0012f6e8) Line 751 + 0xc bytes C++ DumpRenderTree_debug.exe!main(int argc=2, char * * argv=0x01bf1208) Line 1088 + 0xc bytes C++ DumpRenderTree_debug.exe!__tmainCRTStartup() Line 597 + 0x19 bytes C DumpRenderTree_debug.exe!mainCRTStartup() Line 414 C kernel32.dll!_BaseProcessStart@4() + 0x23 bytes
One thing I noticed is that mouseUpCallback doesn't set down to false before calling replaySavedEvents(). I don't know if that's the cause of the problem, though.
<rdar://problem/6310681>
This also affects editing/pasteboard/drop-text-events.html
And fast/events/dragging-mouse-moves.html