Created attachment 138155 [details]
gdb trace of the crash 1
Viewed on ubuntu 16.04.3, Xorg 1.18.4 with various DE
When using a touch screen and using applications based on chrome (chrome, chromium, electron apps), if a menu is opened and the user taps on the window bar, the Xorg server crashes.
The gdb stack traces are attached. The crash seems to be a double free in ProcXIUngrabDevice.
This crash does not happen when using a mouse.
My interpretation (which is surely utterly wrong):
A simple touch to the screen generates a sequence of 3 events: ButtonPress, MotionNotify and ButtonRelease, which is interpreted as a drag. On the window with menu opened, the first ButtonPress makes the app kill the window of the menu but too late before the Xserver interprets the sequence as a Drag event start and tries to drag both windows. At the time the Drag event ends, the window of the menu no longer exists and the ProcXIUngrabDevice happens on an already freed device.
Created attachment 138156 [details]
gdb trace of the crash 2
Reproduced with Chromium on Raspbian 9.
This is not architecture dependent.
*** This bug has been marked as a duplicate of bug 96536 ***