New issue
Advanced search Search tips

Issue 704419 link

Starred by 1 user

Issue metadata

Status: Archived
Owner:
Closed: Mar 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug



Sign in to add a comment

FATAL:PointerEventFactory.cpp(329)] Check failed: touchPoint.state == coalescedTouchPoint.state (3 vs. 4)

Project Member Reported by alemate@chromium.org, Mar 23 2017

Issue description

Debug chrome crashes on ChromeOS OOBE after start (in about 6-10 seconds) on samus:

[1:1:0322/221850.409662:FATAL:PointerEventFactory.cpp(329)] Check failed: touchPoint.state == coalescedTouchPoint.state (3 vs. 4)
#0 0x5fdda304c6b1 base::debug::StackTrace::StackTrace()
#1 0x5fdda304a809 base::debug::StackTrace::StackTrace()
#2 0x5fdda309105b logging::LogMessage::~LogMessage()
#3 0x5fdda9f0712a blink::PointerEventFactory::create()
#4 0x5fddaa2dc246 blink::PointerEventManager::dispatchTouchPointerEvents()
#5 0x5fddaa2dbbb5 blink::PointerEventManager::handleTouchEvents()
#6 0x5fddaa2cb2f2 blink::EventHandler::handleTouchEvent()
#7 0x5fdda92a86b8 blink::PageWidgetEventHandler::handleTouchEvent()
#8 0x5fdda92a82d5 blink::PageWidgetDelegate::handleInputEvent()
#9 0x5fdda9245526 blink::WebViewImpl::handleInputEvent()
#10 0x5fddae3d7f00 blink::WebViewFrameWidget::handleInputEvent()
#11 0x5fddabc106fe content::RenderWidgetInputHandler::HandleInputEvent()
#12 0x5fddab92a9f5 content::RenderWidget::OnHandleInputEvent()
#13 0x5fddab920825 _ZN4base20DispatchToMethodImplIPN7content14RenderViewImplEMS2_FvPKN5blink13WebInputEventERKNSt7__debug6vectorIS7_SaIS7_EEERKN2ui11LatencyInfoENS1_22InputEventDispatchTypeEERKSt5tupleIJS7_SB_SF_SI_EEJLm0ELm1ELm2ELm3EEEEvRKT_T0_OT1_NS_13IndexSequenceIJXspT2_E
EEE
#14 0x5fddab93ba82 _ZN4base16DispatchToMethodIPN7content12RenderWidgetEMS2_FvPKN5blink13WebInputEventERKNSt7__debug6vectorIS7_SaIS7_EEERKN2ui11LatencyInfoENS1_22InputEventDispatchTypeEERKSt5tupleIJS7_SB_SF_SI_EEEEvRKT_T0_OT1_
#15 0x5fddab937ce5 _ZN3IPC16DispatchToMethodIN7content12RenderWidgetEMS2_FvPKN5blink13WebInputEventERKNSt7__debug6vectorIS6_SaIS6_EEERKN2ui11LatencyInfoENS1_22InputEventDispatchTypeEEvSt5tupleIJS6_SA_SE_SH_EEEEvPT_T0_PT1_RKT2_
#16 0x5fddab933262 _ZN3IPC8MessageTI30InputMsg_HandleInputEvent_MetaSt5tupleIJPKN5blink13WebInputEventENSt7__debug6vectorIS6_SaIS6_EEEN2ui11LatencyInfoEN7content22InputEventDispatchTypeEEEvE8DispatchINSD_12RenderWidgetESI_vMSI_FvS6_RKSA_RKSC_SE_EEEbPKNS_7MessageEPT_PT0_PT1_T2
_
#17 0x5fddab927ee5 content::RenderWidget::OnMessageReceived()
#18 0x5fddab90c132 content::RenderViewImpl::OnMessageReceived()
#19 0x5fddac9bccb2 IPC::MessageRouter::RouteMessage()
#20 0x5fdda8e2853f content::ChildThreadImpl::ChildThreadMessageRouter::RouteMessage()
#21 0x5fddac9bcc52 IPC::MessageRouter::OnMessageReceived()
#22 0x5fdda8e2c4c8 content::ChildThreadImpl::OnMessageReceived()
#23 0x5fddab9012b5 _ZN4base8internal13FunctorTraitsIMN7content15ChildThreadImplEFbRKN3IPC7MessageEEvE6InvokeIPNS2_16RenderThreadImplEJS7_EEEbS9_OT_DpOT0_
#24 0x5fddab90037c _ZN4base8internal13FunctorTraitsINS0_18IgnoreResultHelperIMN7content15ChildThreadImplEFbRKN3IPC7MessageEEEEvE6InvokeIRKSB_JPNS3_16RenderThreadImplES8_EEEvOT_DpOT0_
#25 0x5fddab8fed47 _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKNS0_18IgnoreResultHelperIMN7content15ChildThreadImplEFbRKN3IPC7MessageEEEEJPNS5_16RenderThreadImplESA_EEEvOT_DpOT0_
#26 0x5fddab8fbb84 _ZN4base8internal7InvokerINS0_9BindStateINS0_18IgnoreResultHelperIMN7content15ChildThreadImplEFbRKN3IPC7MessageEEEEJNS0_17UnretainedWrapperINS4_16RenderThreadImplEEEEEEFvS9_EE7RunImplIRKSC_RKSt5tupleIJSF_EEJLm0EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEES9_
#27 0x5fddab8f7bb0 _ZN4base8internal7InvokerINS0_9BindStateINS0_18IgnoreResultHelperIMN7content15ChildThreadImplEFbRKN3IPC7MessageEEEEJNS0_17UnretainedWrapperINS4_16RenderThreadImplEEEEEEFvS9_EE3RunEPNS0_13BindStateBaseES9_
#28 0x5fdd9db132b7 base::internal::RunMixin<>::Run()
#29 0x5fddab8f7d7e base::CancelableCallback<>::Forward()
#30 0x5fddab901812 _ZN4base8internal13FunctorTraitsIMNS_18CancelableCallbackIFvRKN3IPC7MessageEEEEKFvS6_EvE6InvokeIRKNS_7WeakPtrIS8_EEJS6_EEEvSA_OT_DpOT0_
#31 0x5fddab90132b _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMNS_18CancelableCallbackIFvRKN3IPC7MessageEEEEKFvS8_ERKNS_7WeakPtrISA_EEJS8_EEEvOT_OT0_DpOT1_
#32 0x5fddab9003e4 _ZN4base8internal7InvokerINS0_9BindStateIMNS_18CancelableCallbackIFvRKN3IPC7MessageEEEEKFvS7_EJNS_7WeakPtrIS9_EEEEES8_E7RunImplIRKSB_RKSt5tupleIJSD_EEJLm0EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEES7_
#33 0x5fddab8feda8 _ZN4base8internal7InvokerINS0_9BindStateIMNS_18CancelableCallbackIFvRKN3IPC7MessageEEEEKFvS7_EJNS_7WeakPtrIS9_EEEEES8_E3RunEPNS0_13BindStateBaseES7_
#34 0x5fdd9db132b7 base::internal::RunMixin<>::Run()
#35 0x5fddabbfa607 content::InputEventFilter::HandleEventOnMainThread()
#36 0x5fddabc099e2 content::MainThreadEventQueue::DispatchInFlightEvent()
#37 0x5fddabc0a00e content::MainThreadEventQueue::DispatchRafAlignedInput()
#38 0x5fddabbf8ef5 content::InputEventFilter::ProcessRafAlignedInput()
#39 0x5fddabc013fd content::InputHandlerManager::ProcessRafAlignedInputOnMainThread()
#40 0x5fddab92ada9 content::RenderWidget::BeginMainFrame()
#41 0x5fddabbe9057 content::RenderWidgetCompositor::BeginMainFrame()
#42 0x5fdda53be03a cc::LayerTreeHost::BeginMainFrame()
#43 0x5fdda543a705 cc::ProxyMain::BeginMainFrame()
#44 0x5fdda5554041 _ZN4base8internal13FunctorTraitsIMN2cc9ProxyMainEFvSt10unique_ptrINS2_28BeginMainFrameAndCommitStateESt14default_deleteIS5_EEEvE6InvokeIRKNS_7WeakPtrIS3_EEJS8_EEEvSA_OT_DpOT0_
#45 0x5fdda5553bf9 _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN2cc9ProxyMainEFvSt10unique_ptrINS4_28BeginMainFrameAndCommitStateESt14default_deleteIS7_EEERKNS_7WeakPtrIS5_EEJSA_EEEvOT_OT0_DpOT1_
#46 0x5fdda555355b _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvSt10unique_ptrINS3_28BeginMainFrameAndCommitStateESt14default_deleteIS6_EEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperIS9_EEEEEFvvEE7RunImplIRKSB_RKSt5tupleIJSD_SF_EEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#47 0x5fdda5552de6 _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvSt10unique_ptrINS3_28BeginMainFrameAndCommitStateESt14default_deleteIS6_EEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperIS9_EEEEEFvvEE3RunEPNS0_13BindStateBaseE
#48 0x5fdd9e3277e0 _ZNO4base8internal8RunMixinINS_8CallbackIFvvELNS0_8CopyModeE0ELNS0_10RepeatModeE0EEEE3RunEv
#49 0x5fdda325fc05 base::debug::TaskAnnotator::RunTask()
#50 0x5fdda915c90a blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue()
#51 0x5fdda915b2ab blink::scheduler::TaskQueueManager::DoWork()
#52 0x5fdda916d95a _ZN4base8internal13FunctorTraitsIMN5blink9scheduler16TaskQueueManagerEFvbEvE6InvokeIRKNS_7WeakPtrIS4_EEJRKbEEEvS6_OT_DpOT0_
#53 0x5fdda916c33d _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN5blink9scheduler16TaskQueueManagerEFvbERKNS_7WeakPtrIS6_EEJRKbEEEvOT_OT0_DpOT1_
#54 0x5fdda9168f25 _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE7RunImplIRKS7_RKSt5tupleIJS9_bEEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#55 0x5fdda916620c _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE3RunEPNS0_13BindStateBaseE
#56 0x5fdd9e3277e0 _ZNO4base8internal8RunMixinINS_8CallbackIFvvELNS0_8CopyModeE0ELNS0_10RepeatModeE0EEEE3RunEv
#57 0x5fdda325fc05 base::debug::TaskAnnotator::RunTask()
#58 0x5fdda30b060f base::MessageLoop::RunTask()
#59 0x5fdda30b077e base::MessageLoop::DeferOrRunPendingTask()
#60 0x5fdda30b0cca base::MessageLoop::DoWork()
#61 0x5fdda30c8bce base::MessagePumpDefault::Run()

[9174:9174:0322/221900.359668:FATAL:login_display_host_impl.cc(1010)] Renderer crash on login window


(CCed to reviewers of last several changes in that file.)
 
Cc: r...@chromium.org

Comment 2 by rbyers@chromium.org, Mar 23 2017

Components: Blink>Input
Owner: nzolghadr@chromium.org
Status: Assigned (was: Untriaged)

Comment 3 by mustaq@chromium.org, Mar 23 2017

Seems this DCHECK should be relaxed: coalescing a touchmove event with state=StateMoved with another with state=StateStationary should be allowed.

alemate@: Did the crash happen during a multitouch gesture?
Status: Started (was: Assigned)
Project Member

Comment 5 by bugdroid1@chromium.org, Mar 23 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/910c2e27c11b75877fb552aa0162a7419944dfed

commit 910c2e27c11b75877fb552aa0162a7419944dfed
Author: nzolghadr <nzolghadr@chromium.org>
Date: Thu Mar 23 17:38:11 2017

Filter out stationary touches from coalesced list

Since stationary touch points are added in our
code and are not real event stream we should
not add those to the list of coalesced events.
This CL filters out all the stationary touch
points from the coalesced event list of a
touch pointer event.

BUG= 704419 

Review-Url: https://codereview.chromium.org/2770713006
Cr-Commit-Position: refs/heads/master@{#459131}

[modify] https://crrev.com/910c2e27c11b75877fb552aa0162a7419944dfed/third_party/WebKit/Source/core/input/PointerEventManager.cpp

Status: Fixed (was: Started)
I just landed the fix in trunk. Let me know if you see any related issues again.

Comment 7 by dchan@google.com, May 30 2017

Labels: VerifyIn-60

Comment 8 by dchan@chromium.org, Aug 1 2017

Labels: VerifyIn-61

Comment 9 by dchan@chromium.org, Jan 22 2018

Status: Archived (was: Fixed)

Sign in to add a comment