Bug 329770

Konqueror crashes by dragging and to drop the home button of Twitter

Reproducible: Always

Steps to Reproduce:
1.Log in Twitter
2.Switch to WebKit engine
3.Put the mouse pointer over the Home button of Twitter (upper black panel, left side)
4.Press the named button with the left click and hold, now drag it a little towards down and left, inside the same page of twitter.
5. Konqueror will crash

If this explanation is not being clear, I could make a video



Backtrace:

Application: Konqueror (konqueror), signal: Segmentation fault
Using host libthread_db library "/lib64/libthread_db.so.1".
[Current thread is 1 (Thread 0x7f7931fee780 (LWP 4188))]

Thread 13 (Thread 0x7f7913600700 (LWP 4189)):
#0  0x00007f792f605913 in select () from /lib64/libc.so.6
#1  0x00007f7930c18261 in QProcessManager::run (this=0x7f7930fa1520 <processManager()::processManager>) at io/qprocess_unix.cpp:247
#2  0x00007f7930b3b68f in QThreadPrivate::start (arg=0x7f7930fa1520 <processManager()::processManager>) at thread/qthread_unix.cpp:338
#3  0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#4  0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 12 (Thread 0x7f7911195700 (LWP 4196)):
#0  0x00007f792f603b3d in poll () from /lib64/libc.so.6
#1  0x00007f792c517604 in g_main_context_poll (priority=2147483647, n_fds=1, fds=0x7f79040013e0, timeout=-1, context=0x7f7904002970) at gmain.c:4007
#2  g_main_context_iterate (context=context@entry=0x7f7904002970, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3708
#3  0x00007f792c51770c in g_main_context_iteration (context=0x7f7904002970, may_block=1) at gmain.c:3774
#4  0x00007f7930c67d55 in QEventDispatcherGlib::processEvents (this=0x7f79040013c0, flags=...) at kernel/qeventdispatcher_glib.cpp:425
#5  0x00007f7930c39d0f in QEventLoop::processEvents (this=this@entry=0x7f7911194e20, flags=...) at kernel/qeventloop.cpp:149
#6  0x00007f7930c3a005 in QEventLoop::exec (this=this@entry=0x7f7911194e20, flags=...) at kernel/qeventloop.cpp:204
#7  0x00007f7930b38fef in QThread::exec (this=this@entry=0x2b20f60) at thread/qthread.cpp:536
#8  0x00007f79279f9efe in KIO::NameLookUpThread::run (this=0x2b20f60) at /usr/src/debug/kdelibs-4.11.3/kio/kio/hostinfo.cpp:226
#9  0x00007f7930b3b68f in QThreadPrivate::start (arg=0x2b20f60) at thread/qthread_unix.cpp:338
#10 0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#11 0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 11 (Thread 0x7f791082d700 (LWP 4197)):
#0  0x00007f79308a8458 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007f7930b3bb44 in wait (time=30000, this=0x7f7904002c10) at thread/qwaitcondition_unix.cpp:84
#2  QWaitCondition::wait (this=<optimized out>, mutex=mutex@entry=0x7f7904002bb8, time=30000) at thread/qwaitcondition_unix.cpp:158
#3  0x00007f7930b2f235 in QThreadPoolThread::run (this=0x7f7904002f20) at concurrent/qthreadpool.cpp:141
#4  0x00007f7930b3b68f in QThreadPrivate::start (arg=0x7f7904002f20) at thread/qthread_unix.cpp:338
#5  0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#6  0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 10 (Thread 0x7f790101f700 (LWP 4204)):
#0  0x00007f79308a8458 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007f7930b3bb44 in wait (time=30000, this=0x2a15d70) at thread/qwaitcondition_unix.cpp:84
#2  QWaitCondition::wait (this=<optimized out>, mutex=mutex@entry=0x2e79d28, time=30000) at thread/qwaitcondition_unix.cpp:158
#3  0x00007f7930b2f235 in QThreadPoolThread::run (this=0x2a21000) at concurrent/qthreadpool.cpp:141
#4  0x00007f7930b3b68f in QThreadPrivate::start (arg=0x2a21000) at thread/qthread_unix.cpp:338
#5  0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#6  0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 9 (Thread 0x7f78fa1e0700 (LWP 4215)):
#0  0x00007f79308a80af in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007f7924625f76 in WTF::TCMalloc_PageHeap::scavengerThread (this=0x7f79250ee5a0 <WTF::pageheap_memory>) at /usr/src/debug/webkit-qtwebkit-23/Source/WTF/wtf/FastMalloc.cpp:2571
#2  0x00007f7924625fa9 in WTF::TCMalloc_PageHeap::runScavengerThread (context=<optimized out>) at /usr/src/debug/webkit-qtwebkit-23/Source/WTF/wtf/FastMalloc.cpp:1767
#3  0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#4  0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 8 (Thread 0x7f78b98dd700 (LWP 4216)):
#0  0x00007f792f603b3d in poll () from /lib64/libc.so.6
#1  0x00007f792c517604 in g_main_context_poll (priority=2147483647, n_fds=1, fds=0x7f78b40027c0, timeout=9999, context=0x7f78b40009a0) at gmain.c:4007
#2  g_main_context_iterate (context=context@entry=0x7f78b40009a0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3708
#3  0x00007f792c51770c in g_main_context_iteration (context=0x7f78b40009a0, may_block=1) at gmain.c:3774
#4  0x00007f7930c67d55 in QEventDispatcherGlib::processEvents (this=0x7f78b40008c0, flags=...) at kernel/qeventdispatcher_glib.cpp:425
#5  0x00007f7930c39d0f in QEventLoop::processEvents (this=this@entry=0x7f78b98dce60, flags=...) at kernel/qeventloop.cpp:149
#6  0x00007f7930c3a005 in QEventLoop::exec (this=this@entry=0x7f78b98dce60, flags=...) at kernel/qeventloop.cpp:204
#7  0x00007f7930b38fef in QThread::exec (this=<optimized out>) at thread/qthread.cpp:536
#8  0x00007f7930b3b68f in QThreadPrivate::start (arg=0x5121720) at thread/qthread_unix.cpp:338
#9  0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#10 0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 7 (Thread 0x7f78b8a5b700 (LWP 4217)):
#0  0x00007f79308a80af in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007f79243982cd in JSC::BlockAllocator::blockFreeingThreadMain (this=0x7f78f9954398) at /usr/src/debug/webkit-qtwebkit-23/Source/JavaScriptCore/heap/BlockAllocator.cpp:128
#2  0x00007f792464dad6 in WTF::wtfThreadEntryPoint (param=0x5347eb0) at /usr/src/debug/webkit-qtwebkit-23/Source/WTF/wtf/ThreadingPthreads.cpp:196
#3  0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#4  0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 6 (Thread 0x7f78a73fc700 (LWP 4220)):
#0  0x00007f792f603b3d in poll () from /lib64/libc.so.6
#1  0x00007f792c517604 in g_main_context_poll (priority=2147483647, n_fds=3, fds=0x7f78a00010c0, timeout=-1, context=0x2c10c00) at gmain.c:4007
#2  g_main_context_iterate (context=0x2c10c00, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3708
#3  0x00007f792c517a6a in g_main_loop_run (loop=0x2892240) at gmain.c:3907
#4  0x00007f78a9e30c16 in gdbus_shared_thread_func (user_data=0x29dc3f0) at gdbusprivate.c:278
#5  0x00007f792c53c035 in g_thread_proxy (data=0x611e0a0) at gthread.c:798
#6  0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#7  0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 5 (Thread 0x7f78a6bfb700 (LWP 4221)):
#0  0x00007f792f603b3d in poll () from /lib64/libc.so.6
#1  0x00007f792c517604 in g_main_context_poll (priority=2147483647, n_fds=2, fds=0x7f78980008c0, timeout=-1, context=0x2aff1e0) at gmain.c:4007
#2  g_main_context_iterate (context=context@entry=0x2aff1e0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3708
#3  0x00007f792c51770c in g_main_context_iteration (context=0x2aff1e0, may_block=may_block@entry=1) at gmain.c:3774
#4  0x00007f792c517759 in glib_worker_main (data=<optimized out>) at gmain.c:5473
#5  0x00007f792c53c035 in g_thread_proxy (data=0x611e2d0) at gthread.c:798
#6  0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#7  0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 4 (Thread 0x7f78a51c8700 (LWP 4224)):
#0  0x00007f79308a80af in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007f78a51e7abb in queue_processor (data=0x5699c90) at /usr/src/debug/icedtea-web-1.4.1/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc:727
#2  0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#3  0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 3 (Thread 0x7f78a49c7700 (LWP 4225)):
#0  0x00007f79308a80af in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007f78a51e7abb in queue_processor (data=0x5699c90) at /usr/src/debug/icedtea-web-1.4.1/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc:727
#2  0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#3  0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 2 (Thread 0x7f789ffff700 (LWP 4226)):
#0  0x00007f79308a80af in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0
#1  0x00007f78a51e7abb in queue_processor (data=0x5699c90) at /usr/src/debug/icedtea-web-1.4.1/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc:727
#2  0x00007f79308a40db in start_thread () from /lib64/libpthread.so.0
#3  0x00007f792f60c90d in clone () from /lib64/libc.so.6

Thread 1 (Thread 0x7f7931fee780 (LWP 4188)):
[KCrash Handler]
#6  0x00007f7923aeb6a1 in WebCore::ClipboardQt::types () from /usr/lib64/libQtWebKit.so.4
#7  0x00007f792322f84e in WebCore::JSClipboard::types () from /usr/lib64/libQtWebKit.so.4
#8  0x00007f7923e113b2 in WebCore::jsClipboardTypes () from /usr/lib64/libQtWebKit.so.4
#9  0x00007f79243fc3f8 in getValue (propertyName=..., exec=0x7f78b3c00228, this=0x7fff6d0eb1a0) at /usr/src/debug/webkit-qtwebkit-23/Source/JavaScriptCore/runtime/PropertySlot.h:76
#10 JSC::JSValue::get (this=<optimized out>, exec=0x7f78b3c00228, propertyName=..., slot=...) at /usr/src/debug/webkit-qtwebkit-23/Source/JavaScriptCore/runtime/JSObject.h:1466
#11 0x00007f79244cde1f in JSC::LLInt::llint_slow_path_get_by_id (exec=0x7f78b3c00228, pc=0x7f789df49d00) at /usr/src/debug/webkit-qtwebkit-23/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:916
#12 0x00007f79244d7d3c in llint_op_get_by_id () from /usr/lib64/libQtWebKit.so.4
#13 0x00007fff6d0eb3f0 in ?? ()
#14 0x000000000000000a in ?? ()
#15 0x00007f789e2a69a0 in ?? ()
#16 0x00007f78b2a0cf80 in ?? ()
#17 0x00007f78b99a649e in ?? ()
#18 0x00007f789e6eec80 in ?? ()
#19 0x00007f789d826d00 in ?? ()
#20 0x00007f78b33ff3e0 in ?? ()
#21 0x0000000000000000 in ?? ()