A Chrome bisect shows that the first Chrome version where this app does not work well was between 52.0.2719.0 and 52.0.2720.0:

ed5a6bb9f4321670482acc32a7cb4246a1e22f25 is the first bad commit
commit ed5a6bb9f4321670482acc32a7cb4246a1e22f25
Author: erikchen <erikchen@chromium.org>
Date:   Thu Apr 28 18:54:39 2016 -0700

    Pepper takes ownership of a mailbox before passing it to the texture layer.
    
    I replaced the IPC message GpuCommandBufferMsg_ProduceFrontBuffer with
    GpuCommandBufferMsg_TakeFrontBuffer and GpuCommandBufferMsg_ReturnFrontBuffer.
    TakeFrontBuffer gives ownership of the front buffer to the client. When the
    client returns it with ReturnFrontBuffer, the command buffer may choose to reuse
    it.
    
    This means that pepper no longer needs to use
    SetTextureMailboxWithoutReleaseCallback.
    
    BUG= 350204 ,  602484 
    CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_optional_gpu_tests_rel;tryserver.chromium.mac:mac_optional_gpu_tests_rel;tryserver.chromium.win:win_optional_gpu_tests_rel
    
    Review-Url: https://codereview.chromium.org/1912833002
    Cr-Commit-Position: refs/heads/master@{#390570}

:040000 040000 50d88bb339629e54e8f945a2af8c7b595cf041ec 682a333d8a5e15daebf2ee51783be9c1794f62c9 M	cc
:040000 040000 0f294a571b13372f3022b1204c59a5ea32514e9c 7ee413de2bcdde80bb624e1813da64d1d296ebad M	components
:040000 040000 33cdefa7b111e6f3e0c258a8daf7aeb4eadf380c b4030579c77856ba340eaf5fc57cbd1e75bf0646 M	content
:040000 040000 2d5fefd11a5b8b51b88af00271a151dfb512871b b61b9d4fbef0e6f71ee84b4f0db1025f254b13c8 M	gpu
:040000 040000 64a75ddec343b3513676b8103571296e3b31b10d 48934b5bb8b9a678ae05cedb168c4095ad2dcf06 M	ppapi


However, with that patch (now reverted), the App is just white (not flashing).

It looks like the (white-screen ends and) flashing starts somewhere between  52.0.2726.0 and 52.0.2727.0.

Hmm there was something wrong with my last bisect.
I tried again @ 52.0.2726.0 and I still see black flashing.
I also trie 52.0.2725.0, but that version crashes immediately upon starting.

I did some more bisecting on my arm64 chromebook.
Here are the results:

[0] ed5a6bb9f4321670482acc32a7cb4246a1e22f25^	Last good version
[1] ed5a6bb9f4321670482acc32a7cb4246a1e22f25	App window is white
[2] 5932a0131851f35b74be5d2fc86a3834defd4d8c	Chrome starts crashing on boot; if reverted, app is white
[3] 04a443352b363a4fdecee6c243ff5c02566a6795	if [2] reverted, app flashes black
[4] 5f1b82e8460a3d4d0a45346cdcdf5862be27c2c7    reverts 5932a0131, fixing crash

So, assigning to erik, since his two patches seem to affect this issue.

The CL in question has been reverted, fixed, and relanded:
https://codereview.chromium.org/1965253002/

The problem you're seeing is likely similar to:
https://bugs.chromium.org/p/chromium/issues/detail?id=610411

Note that 52.0.2726.0 includes Reland#1, which is known to be broken. Can you check to see if the problem still persists on top of tree?

No, "Funky Karts" is not fixed on tot (well, I tried yesterday's ToT: 52.0.2739.0).

Are you able to repro yourself?

@#5 I just checked, and CL:1965253002 landed as [0] in 52.0.2733.0, and is therefore present for my test in #6 (52.0.2739.0).

[0] 438b0447d618fdba716b5898422f7dea8fce472b
[Reland 2] Pepper takes ownership of a mailbox before passing it to the texture layer.

I don't have any Chromebooks, but I can probably borrow a samus from ihf@ again.

Sure, I am still on. Otherwise tomorrow afternoon-ish.

djkurtz: Stupid question: how do you install Funky Karts?

I log in with a Guest account on a samus device, log in to my gmail account, click the link, which says "available for Android" Get it. I click the link, which sends me to the play store, click the install button, and nothing happens...There is a warning that says "You don't have any devices".

In this case you actually need a throwaway test account. Guest mode isn't going to work.

@erik - did you figure it out?  As ihf@ mentioned in #11, you probably need a real account to install the app from the CWS (I use my test gmail account).

I've repro-ed the bug, found the problem, and will have a fix incoming. In the meantime, I bet M52 branched after I landed the pepper changes, so I'll need to revert from that branch.

Thanks Erik!  What was the issue, and where is the CL that fixes it?

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/95ab6d12e8518a9d86abc9b694b9b023543ba5bd

commit 95ab6d12e8518a9d86abc9b694b9b023543ba5bd
Author: erikchen <erikchen@chromium.org>
Date: Thu May 26 05:55:13 2016

gpu: Fix a bug in the new ReturnFrontBuffer() path for pepper.

|offscreen_saved_frame_buffer_| is used for multisampled buffers, and a
workaround. An implicit assumption of GLES2CmdDecoder is that
|offscreen_saved_color_texture_| is always bound to
|offscreen_saved_frame_buffer_|. The new ReturnFrontBuffer() logic violated this
assumption.

BUG= 611016 
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_optional_gpu_tests_rel;tryserver.chromium.mac:mac_optional_gpu_tests_rel;tryserver.chromium.win:win_optional_gpu_tests_rel

Review-Url: https://codereview.chromium.org/2015693002
Cr-Commit-Position: refs/heads/master@{#396129}

[modify] https://crrev.com/95ab6d12e8518a9d86abc9b694b9b023543ba5bd/gpu/command_buffer/service/gles2_cmd_decoder.cc
[modify] https://crrev.com/95ab6d12e8518a9d86abc9b694b9b023543ba5bd/gpu/command_buffer/tests/gl_manager.cc
[modify] https://crrev.com/95ab6d12e8518a9d86abc9b694b9b023543ba5bd/gpu/command_buffer/tests/gl_manager.h
[modify] https://crrev.com/95ab6d12e8518a9d86abc9b694b9b023543ba5bd/gpu/command_buffer/tests/gl_texture_mailbox_unittest.cc

Confirmed: CL:2015693002 fixes "Funky Karts" web app (manually tested on oak).

I still want to revert from M-52 in case there are any yet-undiscovered bugs.

Thank you Erik. Approving revert merge to M52 branch 2743 based on comment #17 and chat with Erik.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/294d74675a0d09e7a59e221f96fed28ba259499b

commit 294d74675a0d09e7a59e221f96fed28ba259499b
Author: erikchen <erikchen@chromium.org>
Date: Thu May 26 19:30:59 2016

[Merge to 2743] Revert "[Reland 2] Pepper takes ownership of a mailbox before passing it to the texture layer."

The CL has at least one bug, so reverting it from 2743 is the safest course of
action.

BUG= 611016 
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel
TBR=ccameron@chromium.org, bbudge@chromium.org, sky@chromium.org, tsepez@chromium.org, piman@chromium.org

Review URL: https://codereview.chromium.org/2012303002 .

Cr-Commit-Position: refs/branch-heads/2743@{#87}
Cr-Branched-From: 2b3ae3b8090361f8af5a611712fc1a5ab2de53cb-refs/heads/master@{#394939}

[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/cc/layers/texture_layer.cc
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/cc/layers/texture_layer.h
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/cc/layers/texture_layer_unittest.cc
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/components/mus/gles2/command_buffer_impl.cc
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/components/mus/gles2/command_buffer_impl.h
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/components/mus/public/interfaces/command_buffer.mojom
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/content/renderer/pepper/pepper_plugin_instance_impl.cc
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/content/renderer/pepper/pepper_plugin_instance_impl.h
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/content/renderer/pepper/ppb_graphics_3d_impl.cc
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/content/renderer/pepper/ppb_graphics_3d_impl.h
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/gpu/command_buffer/service/gles2_cmd_decoder.cc
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/gpu/command_buffer/service/gles2_cmd_decoder.h
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/gpu/command_buffer/service/gles2_cmd_decoder_mock.h
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/gpu/command_buffer/tests/gl_texture_mailbox_unittest.cc
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/gpu/ipc/client/command_buffer_proxy_impl.cc
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/gpu/ipc/client/command_buffer_proxy_impl.h
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/gpu/ipc/common/gpu_messages.h
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/gpu/ipc/service/gpu_channel.cc
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/gpu/ipc/service/gpu_command_buffer_stub.cc
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/gpu/ipc/service/gpu_command_buffer_stub.h
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/ppapi/proxy/ppapi_messages.h
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/ppapi/proxy/ppb_graphics_3d_proxy.cc
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/ppapi/proxy/ppb_graphics_3d_proxy.h
[modify] https://crrev.com/294d74675a0d09e7a59e221f96fed28ba259499b/ppapi/thunk/ppb_graphics_3d_api.h

Moving old issues out of Internal>Graphics to delete this obsolete component ( crbug.com/685425  for details)

Verified on 9592.0.0/60.0.3112.64