New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 622151 link

Starred by 5 users

Issue metadata

Status: Fixed
Owner:
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 1
Type: Bug

Blocking:
issue 551193



Sign in to add a comment

HTC mail client crashes when ImeThread is enabled

Project Member Reported by changwan@chromium.org, Jun 22 2016

Issue description

Version: 52
OS: Android

What steps will reproduce the problem?
(1) Enable ImeThread feature for system webview.
(2) Launch HTC email client.
(3) Reply to any email.
(4) Type a letter.

What is the expected output?
Doesn't crash.

What do you see instead?
The mail client crashes.

Please use labels and text to provide additional information.

 
It seems that HTC mail client tries to do something in setComposingText() assuming that the APIs are running on UI thread.

Crash log:

06-22 11:18:06.171 21943 22093 W WebView : java.lang.Throwable: A WebView method was called on thread 'InputConnectionHandlerThread'. All WebView methods must be called on the same thread. (Expected Looper Looper (main, tid 1) {8625416} called on Looper (InputConnectionHandlerThread, tid 3668) {9bca961}, FYI main Looper is Looper (main, tid 1) {8625416})
06-22 11:18:06.171 21943 22093 W WebView :  at android.webkit.WebView.checkThread(WebView.java:2286)
06-22 11:18:06.171 21943 22093 W WebView :  at android.webkit.WebView.evaluateJavascript(WebView.java:993)
06-22 11:18:06.171 21943 22093 W WebView :  at com.htc.android.mail.compose.u.a(JavaScriptHelper.java:1666)
06-22 11:18:06.171 21943 22093 W WebView :  at com.htc.android.mail.compose.m.a(EditableWebView.java:379)
06-22 11:18:06.171 21943 22093 W WebView :  at com.htc.android.mail.compose.q.setComposingText(EditableWebViewInputConnection.java:105)
06-22 11:18:06.171 21943 22093 W WebView :  at com.android.internal.view.IInputConnectionWrapper.executeMessage(IInputConnectionWrapper.java:340)
06-22 11:18:06.171 21943 22093 W WebView :  at com.android.internal.view.IInputConnectionWrapper$MyHandler.handleMessage(IInputConnectionWrapper.java:78)
06-22 11:18:06.171 21943 22093 W WebView :  at android.os.Handler.dispatchMessage(Handler.java:102)
06-22 11:18:06.171 21943 22093 W WebView :  at android.os.Looper.loop(Looper.java:148)
06-22 11:18:06.171 21943 22093 W WebView :  at android.os.HandlerThread.run(HandlerThread.java:61)
--------- beginning of crash
06-22 11:18:06.172 21943 22093 E AndroidRuntime: FATAL EXCEPTION: InputConnectionHandlerThread
06-22 11:18:06.172 21943 22093 E AndroidRuntime: Process: com.htc.android.mail, PID: 21943
06-22 11:18:06.172 21943 22093 E AndroidRuntime: java.lang.RuntimeException: java.lang.Throwable: A WebView method was called on thread 'InputConnectionHandlerThread'. All WebView methods must be called on the same thread. (Expected Looper Looper (main, tid 1) {8625416} called on Looper (InputConnectionHandlerThread, tid 3668) {9bca961}, FYI main Looper is Looper (main, tid 1) {8625416})
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    at android.webkit.WebView.checkThread(WebView.java:2296)
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    at android.webkit.WebView.evaluateJavascript(WebView.java:993)
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    at com.htc.android.mail.compose.u.a(JavaScriptHelper.java:1666)
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    at com.htc.android.mail.compose.m.a(EditableWebView.java:379)
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    at com.htc.android.mail.compose.q.setComposingText(EditableWebViewInputConnection.java:105)
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    at com.android.internal.view.IInputConnectionWrapper.executeMessage(IInputConnectionWrapper.java:340)
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    at com.android.internal.view.IInputConnectionWrapper$MyHandler.handleMessage(IInputConnectionWrapper.java:78)
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    at android.os.Handler.dispatchMessage(Handler.java:102)
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    at android.os.Looper.loop(Looper.java:148)
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    at android.os.HandlerThread.run(HandlerThread.java:61)
06-22 11:18:06.172 21943 22093 E AndroidRuntime: Caused by: java.lang.Throwable: A WebView method was called on thread 'InputConnectionHandlerThread'. All WebView methods must be called on the same thread. (Expected Looper Looper (main, tid 1) {8625416} called on Looper (InputConnectionHandlerThread, tid 3668) {9bca961}, FYI main Looper is Looper (main, tid 1) {8625416})
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    at android.webkit.WebView.checkThread(WebView.java:2286)
06-22 11:18:06.172 21943 22093 E AndroidRuntime:    ... 9 more

It seems that HTC is doing the following:

1) onCreateInputConnection() returns a wrapper input connection called EditableWebViewInputConnection.
2) IMM calls EditableWebViewInputConnection#setComposingText() on IME thread.
3) EditableWebViewInputConnection calls WebView#evaluateJavascript().
4) WebView#evaluateJavascript() needs to be called on UI thread, so crashes.

I don't think there is a good workaround in this case because IMM talks to HTC's custom input connection before we can intervene.

How about white-listing HTC mail and giving them some time before removing it?

Comment 3 by aelias@chromium.org, Jun 22 2016

evaluateJavascript is async, so why is there a hard dependency on running on the UI thread?  Could we make it safe to call on any thread (e.g. by posting another task)?

Comment 4 by aelias@chromium.org, Jun 22 2016

Cc: r9852508...@gmail.com
Oh, this is in the unchangeable Android Framework part of WebView... I guess there's really no workaround we can do then.

Yes, let's ask HTC mail to change to post a task to the main thread for evaluateJavascript to the UI thread there.  It should be a very simple fix from their end.  Then we should just be cautious only to turn on --use-ime-thread on stable WebView when that fix is sufficiently deployed.

r98525087t2@, are you the right person who can make that change (or can you contact the person who could?)
HTC can verify against the feature by doing the following:
1) adb shell "echo 'webview --enable-features=ImeThread' > /data/local/tmp/webview-command-line"
2) Remove app from overview
3) Launch app again.

HTC Mail overrides InputConnection to do spell check feature. Not sure if no timing issue when post these JavaScript to main thread if user is typing quickly. Please share a test webview version to let HTC Mail to check in early stage, thanks.
Shared the apk file separately. The APK file is based on ToT, except that ImeThread feature is enabled.

You'll still need to follow 'installing onto the device' section in the following document:
https://www.chromium.org/developers/how-tos/build-instructions-android-webview

Hi changwan,

No crash if we post evaluateJavascript to UI thread when ovrride inputconncetion when we enable-features=ImeThread.
We still need time check protential bug (such as timing issue). Such as, we found abnormal values if we call getEditable() to get selection start position. Do you have schedule when it will do production release?

By the way, after install the shared apk. It dumps ClassCastException when we want to get the super.onCreateInputConncetion(editorInfo). But not found the case in play store version(52.0.2743.41)


[Code snipet]
    @Override
    public Editable getEditable(){
        if(Mail.MAIL_DEBUG) ll.d(TAG, "getEditable>");
        return mWVInputConnection.getEditable();
    }
	
	
	@Override
    public boolean commitText(CharSequence text, int newCursorPosition) {
	    ...
	    Editable editable = getEditable();  <-- always empty string
        int selectionStart = Selection.getSelectionStart(editable); <-- selectionStart:0
        ...
	}
	
    @Override
    public InputConnection onCreateInputConnection(EditorInfo editorInfo) {
        if (Mail.MAIL_DEBUG) ll.d(TAG, "onCreateInputConnection>");
        
        BaseInputConnection mWVInputConnection = (BaseInputConnection) super.onCreateInputConnection(editorInfo); <-- crash
        if (mWVInputConnection == null) return null;
        
        mWebviewInputConnection = new EditableWebViewInputConnection(this, mContext, editorInfo, mWVInputConnection, mWeakRefComposeActivity);
        
        // WebViewClassic connection bridge options and input type settings.
        editorInfo.imeOptions = WEBVIEW_CLASSIC_DEFAULT_IME_OPTIONS;
        editorInfo.inputType = WEBVIEW_CLASSIC_DEFAULT_INPUT_TYPE;
        
        return mWebviewInputConnection;
    } 
	
[Log pattern]
06-22 17:13:11.291 19938 19938 D cr_Ime  : [InputMethodManagerWrapper.java:50] showSoftInput
06-22 17:13:11.292 19938 20010 E AndroidRuntime: FATAL EXCEPTION: InputConnectionHandlerThread
06-22 17:13:11.292 19938 20010 E AndroidRuntime: Process: com.htc.android.mail, PID: 19938
06-22 17:13:11.292 19938 20010 E AndroidRuntime: java.lang.RuntimeException: Error occured waiting for callable
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at org.chromium.base.ThreadUtils.runOnUiThreadBlockingNoException(ThreadUtils.java:91)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at org.chromium.content.browser.input.ThreadedInputConnectionProxyView.onCreateInputConnection(ThreadedInputConnectionProxyView.java:54)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at android.view.inputmethod.InputMethodManager.startInputInner(InputMethodManager.java:1197)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at android.view.inputmethod.InputMethodManager$2.run(InputMethodManager.java:1182)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:751)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:95)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at android.os.Looper.loop(Looper.java:173)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at android.os.HandlerThread.run(HandlerThread.java:61)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: Caused by: java.util.concurrent.ExecutionException: java.lang.ClassCastException: org.chromium.content.browser.input.ThreadedInputConnection cannot be cast to android.view.inputmethod.BaseInputConnection
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at java.util.concurrent.FutureTask.report(FutureTask.java:94)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at java.util.concurrent.FutureTask.get(FutureTask.java:164)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at org.chromium.base.ThreadUtils.runOnUiThreadBlocking(ThreadUtils.java:107)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at org.chromium.base.ThreadUtils.runOnUiThreadBlockingNoException(ThreadUtils.java:89)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: ... 7 more
06-22 17:13:11.292 19938 20010 E AndroidRuntime: Caused by: java.lang.ClassCastException: org.chromium.content.browser.input.ThreadedInputConnection cannot be cast to android.view.inputmethod.BaseInputConnection
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at com.htc.android.mail.compose.h.onCreateInputConnection(EditableWebView.java:499)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at org.chromium.content.browser.input.ThreadedInputConnectionProxyView$1.call(ThreadedInputConnectionProxyView.java:57)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at org.chromium.content.browser.input.ThreadedInputConnectionProxyView$1.call(ThreadedInputConnectionProxyView.java:54)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at java.util.concurrent.FutureTask.run(FutureTask.java:237)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:751)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:95)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at android.os.Looper.loop(Looper.java:173)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at android.app.ActivityThread.main(ActivityThread.java:6393)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:873)
06-22 17:13:11.292 19938 20010 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:763)

update the sample apk.

We use the below code and found it will return selectionStart:0 when using ImeThread enable.
Without ImeThread, it will return cursor position value.


[Code snipet]
    @Override
    public boolean commitText(CharSequence text, int newCursorPosition) {
        Log.d(TAG, "commitText>" + text + ", " + newCursorPosition);
       Editable editable = getEditable();
       int selectionStart = Selection.getSelectionStart(editable);
       int selectionEnd = Selection.getSelectionEnd(editable);
       Log.d(TAG, "commitText> selectionStart:"+ selectionStart);
       Log.d(TAG, "commitText> selectionEnd:"+ selectionEnd);

        return mWVInputConnection.commitText(text, newCursorPosition);
    }

[Log]
normal: 
06-22 21:17:28.314 24873 24873 D Hans    : getEditable>
06-22 21:17:28.314 24873 24873 D Hans    : commitText> selectionStart:9
06-22 21:17:28.314 24873 24873 D Hans    : commitText> selectionEnd:9

abnormal:
06-22 21:18:19.625 25529 25623 D Hans    : getEditable>
06-22 21:18:19.625 25529 25623 D Hans    : commitText> selectionStart:0
06-22 21:18:19.625 25529 25623 D Hans    : commitText> selectionEnd:0

Divcontenteditable.7z
3.3 MB Download
WebViewEditor-release.apk
397 KB Download
Please avoid casting it to BaseInputConnection.

It is not correct assumption that WebView will provide a subclass of BaseInputConnection. Well, we still had to base off BaseInputConnection just to avoid crash in some applications like this, but its actual implementation is empty.

You can instead call getExtractedText().selectionStart.

By the way this is quite expensive call. Why do you need to call this?

Hi Changwan,

We can get value from  getExtractedText().selectionStart correctly. Thanks for the advice.

We need to modify editor that's  why we implement EditableWebViewInputConnection extends BaseInputConnection. 
After change to use InputConnection mWVInputConnection = super.onCreateInputConnection(editorInfo), the functions can work.

By the way, this change would cause app unexpected crash on the current production version. In order to avoid surprise to the user, can we know the webview production plan schedule? 
Thanks for the quick answer. As I said earlier, getExtractedText() is an expensive call, especially when the content is heavy. I suggest modifying the editor in the JavaScript side if that is possible.

Regarding webview release schedule, we plan to launch this in M53-54 timeline:
https://www.chromium.org/developers/calendar
(note that webview and chrome release schedules are normally aligned)

Hi Changwan,

We enable IME thread on L51, M60, and N70 with WebView 52.0.2743.49. But we found it does not work on L51. For avoiding surprise, we want to know which android project would be impacted when IME Thread feature enable?

For ExtractedText() function, we want to keep current design. Although it has worse performance, but it cut down race condition risk.  

We cannot control the result as expected if we post JavaScript to get SelectionStart under these threads : IME thread, post UI thread to evaluateJavascript and spellcheck service to do spellcheck.
It will impact L and above where WebView can be updated. It will go through QA for general webview issues, so if it is a generic issue you don't have to worry.
I'll also check it separately. If it is HTC specific, please attach the crash logcat.

FYI, I just tested it again nexus one L 5.1.1, and it worked.
jason.ws.hsu@,

Re #13, could you check again about L51? We're turning this on on M54.
Cc: jason.ws...@gmail.com
Hi Changwan,

We check on L51 with WebView 53.0.2785.70 and use echo to enable ImeThread. But it seems ImeThread did not activate.
Can you share WebView 54 version to test, thanks.

Hi Jason, could you check the file that I shared with you? It's based on M53 and ImeThread is enabled by default. Thanks!
Project Member

Comment 20 by bugdroid1@chromium.org, Aug 26 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f99c4ade4b10c24a59b7bf34de4d7509e7ca8708

commit f99c4ade4b10c24a59b7bf34de4d7509e7ca8708
Author: changwan <changwan@chromium.org>
Date: Fri Aug 26 15:19:39 2016

Prevent thread assertion for HTC mail apk

HTC's mail apk calls evaluateJavaScript() inside
InputConnection#setComposingText(). This is problematic with ImeThread
feature since InputConnection methods are now running on its own thread
(IME thread). This causes a thread check assertion in Android's framework
(android.webkit.WebView).

As a workaround, we set sEnforceThreadChecking to false immediately after
it was set in WebView's constructor.

HTC is actively fixing their apk to avoid this crash, but as a last resort,
this workaround will help avoid such a crash.

BUG=636717,  622151 

Review-Url: https://codereview.chromium.org/2243753002
Cr-Commit-Position: refs/heads/master@{#414717}

[modify] https://crrev.com/f99c4ade4b10c24a59b7bf34de4d7509e7ca8708/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java
[modify] https://crrev.com/f99c4ade4b10c24a59b7bf34de4d7509e7ca8708/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumFactoryProvider.java

Project Member

Comment 21 by bugdroid1@chromium.org, Aug 29 2016

The following revision refers to this bug:
  https://chrome-internal.googlesource.com/clank/internal/apps/+/ea8ace51901aeab6570642054b9b55ce103cdd13

commit ea8ace51901aeab6570642054b9b55ce103cdd13
Author: changwan <changwan@chromium.org>
Date: Fri Aug 26 15:19:39 2016

Project Member

Comment 22 by bugdroid1@chromium.org, Aug 29 2016

Labels: merge-merged-2840
The following revision refers to this bug:
  https://chrome-internal.googlesource.com/clank/internal/apps/+/0f703f798206bba8ab4dc0950ccefdf05be1b893

commit 0f703f798206bba8ab4dc0950ccefdf05be1b893
Author: Changwan Ryu <changwan@google.com>
Date: Mon Aug 29 02:39:23 2016

Project Member

Comment 23 by bugdroid1@chromium.org, Aug 29 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e1d506220fb8a5993f7025c0e91aafb502bb7b6d

commit e1d506220fb8a5993f7025c0e91aafb502bb7b6d
Author: Changwan Ryu <changwan@google.com>
Date: Mon Aug 29 02:40:27 2016

Prevent thread assertion for HTC mail apk

HTC's mail apk calls evaluateJavaScript() inside
InputConnection#setComposingText(). This is problematic with ImeThread
feature since InputConnection methods are now running on its own thread
(IME thread). This causes a thread check assertion in Android's framework
(android.webkit.WebView).

As a workaround, we set sEnforceThreadChecking to false immediately after
it was set in WebView's constructor.

HTC is actively fixing their apk to avoid this crash, but as a last resort,
this workaround will help avoid such a crash.

BUG=636717,  622151 

Review-Url: https://codereview.chromium.org/2243753002
Cr-Commit-Position: refs/heads/master@{#414717}
(cherry picked from commit f99c4ade4b10c24a59b7bf34de4d7509e7ca8708)

Review URL: https://codereview.chromium.org/2288053002 .

Cr-Commit-Position: refs/branch-heads/2840@{#12}
Cr-Branched-From: 1ae106dbab4bddd85132d5b75c670794311f4c57-refs/heads/master@{#414607}

[modify] https://crrev.com/e1d506220fb8a5993f7025c0e91aafb502bb7b6d/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java
[modify] https://crrev.com/e1d506220fb8a5993f7025c0e91aafb502bb7b6d/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumFactoryProvider.java

Project Member

Comment 24 by bugdroid1@chromium.org, Oct 27 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e1d506220fb8a5993f7025c0e91aafb502bb7b6d

commit e1d506220fb8a5993f7025c0e91aafb502bb7b6d
Author: Changwan Ryu <changwan@google.com>
Date: Mon Aug 29 02:40:27 2016

Prevent thread assertion for HTC mail apk

HTC's mail apk calls evaluateJavaScript() inside
InputConnection#setComposingText(). This is problematic with ImeThread
feature since InputConnection methods are now running on its own thread
(IME thread). This causes a thread check assertion in Android's framework
(android.webkit.WebView).

As a workaround, we set sEnforceThreadChecking to false immediately after
it was set in WebView's constructor.

HTC is actively fixing their apk to avoid this crash, but as a last resort,
this workaround will help avoid such a crash.

BUG=636717,  622151 

Review-Url: https://codereview.chromium.org/2243753002
Cr-Commit-Position: refs/heads/master@{#414717}
(cherry picked from commit f99c4ade4b10c24a59b7bf34de4d7509e7ca8708)

Review URL: https://codereview.chromium.org/2288053002 .

Cr-Commit-Position: refs/branch-heads/2840@{#12}
Cr-Branched-From: 1ae106dbab4bddd85132d5b75c670794311f4c57-refs/heads/master@{#414607}

[modify] https://crrev.com/e1d506220fb8a5993f7025c0e91aafb502bb7b6d/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java
[modify] https://crrev.com/e1d506220fb8a5993f7025c0e91aafb502bb7b6d/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumFactoryProvider.java

Status: Fixed (was: Started)

Sign in to add a comment