Crash when drag and drop a split view tab

[GeetaSarvadnya]

Description

Found while testing #43213

Crash when drag and drop a split view tab

Steps to reproduce

1. Clean profile 1.77.54 CR134
2. Have several tabs open and also have a split view.
3. Select the split view tabs and drag and drop to different positions within a full tab bar.
4. Select split view tabs and drag the split view out to create a new window
5. Drag the selected split view window back into the original window
6. Brave crashes

Actual result

Brave crashes

Uploaded Crash Report ID: | be880700-b339-6c0d-0000-000000000000
Upload Time: | Friday, February 21, 2025 at 3:02:35 PM

Expected result

Brave should not crash

Reproduces how often

Easily reproduced

Brave version (brave://version info)

Brave	1.77.54 Chromium: 134.0.6998.15 (Official Build) nightly (64-bit)
Revision	b5eb0ad650247021f99f74cbe6a98cfe9cd02868
OS	Windows 10 Version 22H2 (Build 19045.5487)

Channel information

• release (stable)
• beta
• nightly

Reproducibility

• with Brave Shields disabled
• with Brave Rewards disabled
• in the latest version of Chrome

Miscellaneous information

cc: @rebron @brave/qa-team @simonhong

[LaurenWags]

Callstack from be880700-b339-6c0d-0000-000000000000:

[ 00 ] ImmediateCrash() ( immediate_crash.h:186 )
[ 01 ] CheckFailure() ( check.h:253 )
[ 02 ] SplitViewTabStripModelAdapter::SynchronizePinnedState(TabTile const &,SupportsHandles<tabs::TabInterface,int>::Handle const &) ( split_view_tab_strip_model_adapter.cc:90 )
[ 03 ] SplitViewBrowserData::TileTabs(TabTile const &) ( split_view_browser_data.cc:45 )
[ 04 ] SplitViewBrowserData::Transfer(SplitViewBrowserData *,std::__Cr::vector<TabTile,std::__Cr::allocator<TabTile> >) ( split_view_browser_data.cc:103 )
[ 05 ] SplitViewBrowserData::TabsAttachedToNewBrowser(Browser *) ( split_view_browser_data.cc:242 )
[ 06 ] TabDragController::DetachAndAttachToNewContext(TabDragControllerChromium::ReleaseCapture,TabDragContext *) ( tab_drag_controller.cc:208 )
[ 07 ] TabDragControllerChromium::DetachIntoNewBrowserAndRunMoveLoop(gfx::Point const &) ( tab_drag_controller.cc:1658 )
[ 08 ] TabDragControllerChromium::ContinueDragging(gfx::Point const &) ( tab_drag_controller.cc:907 )
[ 09 ] TabDragController::ContinueDragging(gfx::Point const &) ( tab_drag_controller.cc:278 )
[ 10 ] TabDragControllerChromium::Drag(gfx::Point const &) ( tab_drag_controller.cc:719 )
[ 11 ] TabStrip::TabDragContextImpl::ContinueDrag(views::View *,ui::LocatedEvent const &) ( tab_strip.cc:363 )
[ 12 ] TabStrip::TabDragContextImpl::OnMouseDragged(ui::MouseEvent const &) ( tab_strip.cc:188 )
[ 13 ] views::View::ProcessMouseDragged(ui::MouseEvent *) ( view.cc:3597 )
[ 14 ] ui::EventDispatcher::DispatchEvent(ui::EventHandler *,ui::Event *) ( event_dispatcher.cc:190 )
[ 15 ] ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget *,ui::Event *) ( event_dispatcher.cc:92 )
[ 16 ] ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget *,ui::Event *) ( event_dispatcher.cc:56 )
[ 17 ] views::internal::RootView::OnMouseDragged(ui::MouseEvent const &) ( root_view.cc:603 )
[ 18 ] views::Widget::OnMouseEvent(ui::MouseEvent *) ( widget.cc:2100 )
[ 19 ] views::DesktopNativeWidgetAura::OnMouseEvent(ui::MouseEvent *) ( desktop_native_widget_aura.cc:1390 )
[ 20 ] ui::EventDispatcher::DispatchEvent(ui::EventHandler *,ui::Event *) ( event_dispatcher.cc:190 )
[ 21 ] ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget *,ui::Event *) ( event_dispatcher.cc:92 )
[ 22 ] ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget *,ui::Event *) ( event_dispatcher.cc:56 )
[ 23 ] ui::EventProcessor::OnEventFromSource(ui::Event *) ( event_processor.cc:21 )
[ 24 ] ui::EventSource::DeliverEventToSink(ui::Event *) ( event_source.cc:119 )
[ 25 ] ui::EventSource::SendEventToSinkFromRewriter(ui::Event const *,ui::EventRewriter const *) ( event_source.cc:134 )
[ 26 ] ui::EventSource::SendEventToSink(ui::Event const *) ( event_source.cc:113 )
[ 27 ] views::DesktopWindowTreeHostWin::HandleMouseEvent(ui::MouseEvent *) ( desktop_window_tree_host_win.cc:1187 )
[ 28 ] views::HWNDMessageHandler::HandleMouseEventInternal(unsigned int,unsigned __int64,__int64,bool) ( hwnd_message_handler.cc:3300 )
[ 29 ] base::AtomicFlag::IsSet() ( atomic_flag.h:37 )
[ 30 ] base::internal::WeakReference::Flag::IsValid() ( weak_ptr.cc:39 )
[ 31 ] base::internal::WeakReference::IsValid() ( weak_ptr.cc:75 )
[ 32 ] views::HWNDMessageHandler::_ProcessWindowMessage(HWND__ *,unsigned int,unsigned __int64,__int64,__int64 &,unsigned long) ( hwnd_message_handler.h:0 )
[ 33 ] views::HWNDMessageHandler::OnWndProc(unsigned int,unsigned __int64,__int64) ( hwnd_message_handler.cc:1110 )
[ 34 ] gfx::WindowImpl::WndProc(HWND__ *,unsigned int,unsigned __int64,__int64) ( window_impl.cc:311 )
[ 35 ] base::win::WrappedWindowProc<&gfx::WindowImpl::WndProc>(HWND__ *,unsigned int,unsigned __int64,__int64) ( wrapped_window_proc.h:77 )
[ 36 ] UserCallWinProcCheckWow(struct _ACTIVATION_CONTEXT *,__int64 (*)(struct tagWND *,unsigned int,unsigned __int64,__int64),struct HWND__ *,enum _WM_VALUE,unsigned __int64,__int64,void *,int)
[ 37 ] DispatchMessageWorker
[ 38 ] base::MessagePumpForUI::ProcessMessageHelper(tagMSG const &) ( message_pump_win.cc:630 )
[ 39 ] base::MessagePumpForUI::ProcessNextWindowsMessage() ( message_pump_win.cc:591 )
[ 40 ] base::MessagePumpForUI::DoRunLoop() ( message_pump_win.cc:251 )
[ 41 ] base::MessagePumpWin::Run(base::MessagePump::Delegate *) ( message_pump_win.cc:89 )
[ 42 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool,base::TimeDelta) ( thread_controller_with_message_pump_impl.cc:632 )
[ 43 ] base::RunLoop::Run(base::Location const &) ( run_loop.cc:136 )
[ 44 ] content::BrowserMainLoop::RunMainMessageLoop() ( browser_main_loop.cc:1091 )
[ 45 ] content::BrowserMainRunnerImpl::Run() ( browser_main_runner_impl.cc:156 )
[ 46 ] content::BrowserMain(content::MainFunctionParams) ( browser_main.cc:32 )
[ 47 ] RunBrowserProcessMain(content::MainFunctionParams,content::ContentMainDelegate *) ( content_main_runner_impl.cc:710 )
[ 48 ] content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams,bool) ( content_main_runner_impl.cc:1289 )
[ 49 ] content::ContentMainRunnerImpl::Run() ( content_main_runner_impl.cc:1143 )
[ 50 ] RunContentProcess(content::ContentMainParams,content::ContentMainRunner *) ( content_main.cc:353 )
[ 51 ] content::ContentMain(content::ContentMainParams) ( content_main.cc:366 )
[ 52 ] ChromeMain(HINSTANCE__ *,sandbox::SandboxInterfaceInfo *,__int64,__int64,__int64) ( chrome_main.cc:224 )
[ 53 ] MainDllLoader::Launch(HINSTANCE__ *,base::TimeTicks) ( main_dll_loader_win.cc:201 )
[ 54 ] wWinMain(HINSTANCE__ *,HINSTANCE__ *,wchar_t *,int) ( chrome_exe_main_win.cc:352 )
[ 55 ] invoke_main() ( exe_common.inl:118 )
[ 56 ] __scrt_common_main_seh() ( exe_common.inl:288 )
[ 57 ] BaseThreadInitThunk
[ 58 ] RtlUserThreadStart

[simonhong]

Checking.

[GeetaSarvadnya]

Reproduced the issue on macOS arm64 - 1.76.68 Chromium: 134.0.6998.24

Status: | Uploaded
-- | --
Uploaded crash report ID: | 65a70300-1c70-750d-0000-000000000000
Upload time: | Thursday 27 February 2025 at 18:24:19

[MadhaviSeelam]

Reproduced the issue when drag and dropped two sets of split view tabs in groups

Brave | 1.77.70 Chromium: 134.0.6998.39 (Official Build) beta (64-bit)
-- | --
Revision | b60c7cd8d406b81e34e6b56fec0f0a787ba7c990
OS | Windows 11 Version 24H2 (Build 26100.3194)

Status: | Uploaded
-- | --
Uploaded Crash Report ID: | 9c800500-1c70-750d-0000-000000000000
Upload Time: | Thursday, February 27, 2025 at 2:27:05 PM

2025-02-27_14h26_55.mp4