Crash while painting sfgate.com |
|||||||||
Issue descriptionJust load it and wait, happens sooner or later, often upon interaction. [1:1:0516/135347.869901:FATAL:PaintLayerPainter.cpp(292)] Check failed: paint_layer_.IsSelfPaintingLayer() || paint_layer_.HasSelfPaintingLayerDescendant(). #0 0x55bb28320697 base::debug::StackTrace::StackTrace() #1 0x55bb2833a29d logging::LogMessage::~LogMessage() #2 0x55bb2ab7f896 blink::PaintLayerPainter::PaintLayerContents() #3 0x55bb2aa43f49 blink::CompositedLayerMapping::DoPaintTask() #4 0x55bb2aa44a2c blink::CompositedLayerMapping::PaintContents() #5 0x55bb2bef4730 blink::GraphicsLayer::PaintWithoutCommit() #6 0x55bb2bef4117 blink::GraphicsLayer::Paint() #7 0x55bb2a83ce41 blink::FrameView::PaintGraphicsLayerRecursively() #8 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #9 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #10 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #11 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #12 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #13 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #14 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #15 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #16 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #17 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #18 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #19 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #20 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #21 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #22 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #23 0x55bb2a83be50 blink::FrameView::PaintTree() #24 0x55bb2a839805 blink::FrameView::UpdateLifecyclePhasesInternal() #25 0x55bb2a839211 blink::FrameView::UpdateAllLifecyclePhases() #26 0x55bb2ab1c35a blink::PageAnimator::UpdateAllLifecyclePhases() #27 0x55bb2ad0d584 blink::WebViewImpl::UpdateAllLifecyclePhases() #28 0x55bb2af108b7 content::RenderWidget::UpdateVisualState() #29 0x55bb2937d1b1 cc::ProxyMain::BeginMainFrame() #30 0x55bb293ec1b3 _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvSt10unique_ptrINS3_28BeginMainFrameAndCommitStateESt14default_deleteIS6_EEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperIS9_EEEEEFvvEE7RunImplISB_St5tupleIJSD_SF_EEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE #31 0x55bb26637ed1 _ZNO4base8CallbackIFvvELNS_8internal8CopyModeE1ELNS2_10RepeatModeE1EE3RunEv #32 0x55bb283cf4d3 base::debug::TaskAnnotator::RunTask() #33 0x55bb2a7e2283 blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue() #34 0x55bb2a7dfc5e blink::scheduler::TaskQueueManager::DoWork() #35 0x55bb26a6c677 _ZN4base8internal7InvokerINS0_9BindStateIMN6policy17AsyncPolicyLoaderEFvbEJNS_7WeakPtrIS4_EEbEEEFvvEE3RunEPNS0_13BindStateBaseE #36 0x55bb26637ed1 _ZNO4base8CallbackIFvvELNS_8internal8CopyModeE1ELNS2_10RepeatModeE1EE3RunEv #37 0x55bb283cf4d3 base::debug::TaskAnnotator::RunTask() #38 0x55bb28340c2d base::MessageLoop::RunTask() #39 0x55bb28340ecc base::MessageLoop::DeferOrRunPendingTask() #40 0x55bb28341286 base::MessageLoop::DoWork() #41 0x55bb28342979 base::MessagePumpDefault::Run() #42 0x55bb28340995 base::MessageLoop::RunHandler() #43 0x55bb2836956c base::RunLoop::Run() #44 0x55bb2af1d4ff content::RendererMain() #45 0x55bb27ef004a content::RunZygote() #46 0x55bb27ef05f0 content::RunNamedProcessTypeMain() #47 0x55bb27ef1322 content::ContentMainRunnerImpl::Run() #48 0x55bb27ef8bb4 service_manager::Main() #49 0x55bb27eefe22 content::ContentMain() #50 0x55bb266333c5 ChromeMain #51 0x7f31199a6f45 __libc_start_main #52 0x55bb2663322d <unknown> Received signal 6 #0 0x55bb28320697 base::debug::StackTrace::StackTrace() #1 0x55bb2832020f base::debug::(anonymous namespace)::StackDumpSignalHandler() #2 0x7f311fd77330 <unknown> #3 0x7f31199bbc37 gsignal #4 0x7f31199bf028 abort #5 0x55bb2831f0d2 base::debug::BreakDebugger() #6 0x55bb2833a660 logging::LogMessage::~LogMessage() #7 0x55bb2ab7f896 blink::PaintLayerPainter::PaintLayerContents() #8 0x55bb2aa43f49 blink::CompositedLayerMapping::DoPaintTask() #9 0x55bb2aa44a2c blink::CompositedLayerMapping::PaintContents() #10 0x55bb2bef4730 blink::GraphicsLayer::PaintWithoutCommit() #11 0x55bb2bef4117 blink::GraphicsLayer::Paint() #12 0x55bb2a83ce41 blink::FrameView::PaintGraphicsLayerRecursively() #13 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #14 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #15 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #16 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #17 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #18 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #19 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #20 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #21 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #22 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #23 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #24 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #25 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #26 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #27 0x55bb2a83ceab blink::FrameView::PaintGraphicsLayerRecursively() #28 0x55bb2a83be50 blink::FrameView::PaintTree() #29 0x55bb2a839805 blink::FrameView::UpdateLifecyclePhasesInternal() #30 0x55bb2a839211 blink::FrameView::UpdateAllLifecyclePhases() #31 0x55bb2ab1c35a blink::PageAnimator::UpdateAllLifecyclePhases() #32 0x55bb2ad0d584 blink::WebViewImpl::UpdateAllLifecyclePhases() #33 0x55bb2af108b7 content::RenderWidget::UpdateVisualState() #34 0x55bb2937d1b1 cc::ProxyMain::BeginMainFrame() #35 0x55bb293ec1b3 _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvSt10unique_ptrINS3_28BeginMainFrameAndCommitStateESt14default_deleteIS6_EEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperIS9_EEEEEFvvEE7RunImplISB_St5tupleIJSD_SF_EEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE #36 0x55bb26637ed1 _ZNO4base8CallbackIFvvELNS_8internal8CopyModeE1ELNS2_10RepeatModeE1EE3RunEv #37 0x55bb283cf4d3 base::debug::TaskAnnotator::RunTask() #38 0x55bb2a7e2283 blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue() #39 0x55bb2a7dfc5e blink::scheduler::TaskQueueManager::DoWork() #40 0x55bb26a6c677 _ZN4base8internal7InvokerINS0_9BindStateIMN6policy17AsyncPolicyLoaderEFvbEJNS_7WeakPtrIS4_EEbEEEFvvEE3RunEPNS0_13BindStateBaseE #41 0x55bb26637ed1 _ZNO4base8CallbackIFvvELNS_8internal8CopyModeE1ELNS2_10RepeatModeE1EE3RunEv #42 0x55bb283cf4d3 base::debug::TaskAnnotator::RunTask() #43 0x55bb28340c2d base::MessageLoop::RunTask() #44 0x55bb28340ecc base::MessageLoop::DeferOrRunPendingTask() #45 0x55bb28341286 base::MessageLoop::DoWork() #46 0x55bb28342979 base::MessagePumpDefault::Run() #47 0x55bb28340995 base::MessageLoop::RunHandler() #48 0x55bb2836956c base::RunLoop::Run() #49 0x55bb2af1d4ff content::RendererMain() #50 0x55bb27ef004a content::RunZygote() #51 0x55bb27ef05f0 content::RunNamedProcessTypeMain() #52 0x55bb27ef1322 content::ContentMainRunnerImpl::Run() #53 0x55bb27ef8bb4 service_manager::Main() #54 0x55bb27eefe22 content::ContentMain() #55 0x55bb266333c5 ChromeMain #56 0x7f31199a6f45 __libc_start_main #57 0x55bb2663322d <unknown> r8: ffff8391cf6ab308 r9: ffff8391cf6ab2f8 r10: 0000000000000008 r11: 0000000000000202 r12: 00007f311a265940 r13: 00007ffcbf44b408 r14: 000000000000009d r15: 00007ffcbf44b400 di: 0000000000000001 si: 0000000000000001 bp: 000028911df741b0 bx: 00007ffcbf44ad30 dx: 0000000000000006 ax: 0000000000000000 cx: 00007f31199bbc37 sp: 00007ffcbf44ab98 ip: 00007f31199bbc37 efl: 0000000000000202 cgf: 0000000000000033 erf: 0000000000000000 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000 [end of stack trace]
,
May 16 2017
I might have had corrupt build.
,
May 16 2017
Clean build
,
May 16 2017
,
May 16 2017
,
May 16 2017
,
May 16 2017
Attempting assignment and CC to a few people in the know of painting stuff. This is P1 as it's hitting a DCHECK in normal dev build operations. Thanks for your help
,
May 17 2017
,
May 17 2017
The problematic layer: 1. was created because the object requires kOverflowClipPaintLayer type of layer; 2. is not composited scrolling; 3. it has an active accelerated animation or transition. Because of 1 and 2, the layer isn't marked as self painting, but because of 3 it's composited so is directly painted. Is "composited but not self-painting" a valid status of a layer?
,
May 17 2017
Non-self-painting composited layers are not allowed. What is the active accelerated animation/transition? The underlying CSS that causes that should be a trigger for a self-painting PaintLayer.
,
May 17 2017
It's animating opacity from 0 to 1 (100 actually in the page, but we clamp to 1). The DCHECK failure happens when opacity becomes 1 at the end of the animation: the layer becomes non-self-painting before we remove the composited layer. The animation is handled in cc, but somehow the layer keeps repainting itself, and triggers the DCHECK if the layer happens to repaint at the end of the animation. I'm trying to create a test case but haven't succeeded yet.
,
May 17 2017
ShouldCompositeForCurrentAnimations() being true should trigger a self-painting PaintLayer...why would that be false?
,
May 17 2017
It seems in the following sequence: 1. ShouldCompositeForCurrentAnimations() becomes false; 2. The layer becomes non-self-painting (but still composited); 3. The layer repaints; 4. (If DCHECK is disabled) the layer becomes non-compositing according to the new compositing reasons. Don't know why 4 is delayed to the next lifecycle.
,
May 17 2017
More debugging showed that 1,2,3 are in the same lifecycle. Before compositing update of that lifecycle, the layer was set NeedsCompositingInputsUpdate, but somehow the compositing update did nothing, leaving stale compositing status of the layer. Reproduction of the bug seems related to the contents of sfgate.com which change from time to time. Reproduction rate seemed high when Donald Trump was in the page :)
,
May 17 2017
This is related to frame throttling. After 1 and 2 there is no compositing update because the frame is throttled. However, during painting, we will still paint composited layers in the throttled frame.
,
May 19 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/b0f1618f1c3f17a71ae3eb538bb326d329869309 commit b0f1618f1c3f17a71ae3eb538bb326d329869309 Author: wangxianzhu <wangxianzhu@chromium.org> Date: Fri May 19 05:22:13 2017 Fix DCHECK failure when PaintLayerContents() paints layer in throttled frame Move the early return for throttled frame above the DCHECK about self-painting layer status. BUG= 723014 CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2 Review-Url: https://codereview.chromium.org/2893803002 Cr-Commit-Position: refs/heads/master@{#473095} [modify] https://crrev.com/b0f1618f1c3f17a71ae3eb538bb326d329869309/third_party/WebKit/Source/core/paint/PaintLayerPainter.cpp [modify] https://crrev.com/b0f1618f1c3f17a71ae3eb538bb326d329869309/third_party/WebKit/Source/web/tests/FrameThrottlingTest.cpp
,
May 19 2017
,
May 23 2017
@wangxianzhu-- Could you please provide us the sample test case or test steps to verify the issue , from test team End . Thanks!
,
May 23 2017
I haven't created an HTML test case (though there is a unit test) for this, so the only way to manually test this is to repeat the reproduction steps in the bug report. Note that it was reproducible on debug builds and non-official release builds only, not on official release builds. |
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by pfeldman@chromium.org
, May 16 2017