[Tracker] crashes in BPrivate::BPose::WidgetFor

[diver]

Tracker crashed when I was trying to drop a package to /system/packages

Debug information for team /boot/system/Tracker (121):
CPU(s): 1x Intel Core™ i7-3635QM
Memory: 2.00 GiB total, 383.59 MiB used
Haiku revision: hrev58461 Dec 24 2024 07:02:20 (x86_64)

Active Threads:
	thread 121: Tracker (main)
	thread 152: launch looper 
	thread 161: w>/boot/home/Desktop 
	thread 178: PathMonitor looper 
	thread 201: w>Tracker status 
	thread 204: TrashWatcher 
	thread 205: ClipboardRefsWatcher 
	thread 207: TrackerTaskLoop 
	thread 574: w>/boot/home 
	thread 599: team 121 debug task 
	thread 377: w>/boot/system/packages 
		state: Exception (General protection fault)

		Frame		IP			Function Name
		-----------------------------------------------
		0x7f6a79c00ce0	0xc33d76a2c4	BPrivate::BPose::WidgetFor(unsigned int, int*) const + 0x44 
			Disassembly:
				BPrivate::BPose::WidgetFor(unsigned int, int*) const:
				0x000000c33d76a280:               55  push %rbp
				0x000000c33d76a281:           4889e5  mov %rsp, %rbp
				0x000000c33d76a284:             4157  push %r15
				0x000000c33d76a286:             4156  push %r14
				0x000000c33d76a288:           4989d6  mov %rdx, %r14
				0x000000c33d76a28b:             4155  push %r13
				0x000000c33d76a28d:           4189f5  mov %esi, %r13d
				0x000000c33d76a290:             4154  push %r12
				0x000000c33d76a292:               53  push %rbx
				0x000000c33d76a293:         488d5f10  lea 0x10(%rdi), %rbx
				0x000000c33d76a297:           4889df  mov %rbx, %rdi
				0x000000c33d76a29a:         4883ec08  sub $0x8, %rsp
				0x000000c33d76a29e:       e88d3ef9ff  call 0xc33d6fe130
				0x000000c33d76a2a3:             85c0  test %eax, %eax
				0x000000c33d76a2a5:             7e41  jle 0xc33d76a2e8
				0x000000c33d76a2a7:           4189c4  mov %eax, %r12d
				0x000000c33d76a2aa:           4531ff  xor %r15d, %r15d
				0x000000c33d76a2ad:             eb0a  jmp 0xc33d76a2b9
				0x000000c33d76a2af:               90  nop
				0x000000c33d76a2b0:         4183c701  add $0x1, %r15d
				0x000000c33d76a2b4:           4539e7  cmp %r12d, %r15d
				0x000000c33d76a2b7:             742f  jz 0xc33d76a2e8
				0x000000c33d76a2b9:           4489fe  mov %r15d, %esi
				0x000000c33d76a2bc:           4889df  mov %rbx, %rdi
				0x000000c33d76a2bf:       e8ec3df9ff  call 0xc33d6fe0b0
				0x000000c33d76a2c4:         443b6810  cmpl 0x10(%rax), %r13d <--

			Frame memory:
				[0x7f6a79c00ca0]  .......? ..yj...   00 00 00 00 00 00 f0 3f 20 0d c0 79 6a 7f 00 00
				[0x7f6a79c00cb0]  ..L8_...........   10 f5 4c 38 5f 10 00 00 00 00 00 00 00 00 00 00
				[0x7f6a79c00cc0]  .qM8_......yj...   f0 71 4d 38 5f 10 00 00 90 0d c0 79 6a 7f 00 00
				[0x7f6a79c00cd0]  p..yj.....v=....   70 0d c0 79 6a 7f 00 00 b6 be 76 3d c3 00 00 00
		0x7f6a79c00d80	0xc33d76beb1	BPrivate::BPose::PointInPose(BPoint, BPrivate::BPoseView const*, BPoint, BPrivate::BTextWidget**) const + 0xa1 
		0x7f6a79c00de0	0xc33d771feb	BPrivate::BPoseView::FindPose(BPoint, int*) const + 0xbb 
		0x7f6a79c01030	0xc33d78a0f8	BPrivate::BPoseView::UpdateDropTarget(BPoint, BMessage const*, bool) + 0x38 
		0x7f6a79c01080	0xc33d78a52e	BPrivate::BPoseView::MouseMoved(BPoint, unsigned int, BMessage const*) + 0x10e 
		0x7f6a79c01210	0xa3c8ec5b34	BView::MessageReceived(BMessage*) + 0xb84 
		0x7f6a79c012a0	0xa3c8ec9843	BWindow::task_looper() + 0x1d3 
		0x7f6a79c012c0	0xa3c8e0a71b	BLooper::_task0_(void*) + 0x1b 
		0x7f6a79c012e0	0x2082807b187	thread_entry + 0x17 
		00000000	0x7f65d99e1258	commpage_thread_exit + 0 }}}

[waddlesplash]

Reproducible? Recent regression? What happens under the guarded heap?

Looks a bit like #19300. What happens if filtering is disabled?

[diver]

Reproducible. Seems to only happen with type ahead filter is applied to the window.

[waddlesplash]

Fix merged in hrev58465. Please check #19318 also.