Layout DCHECK when <div> goes fullscreen with { position: fixed; }
Reported by
ptwo...@opera.com,
Jun 21 2017
|
||||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.104 Safari/537.36 Steps to reproduce the problem: 1. Grab chromium build with DCHECKs enabled 2. Load http://dashif.org/reference/players/javascript/v2.4.0/samples/dash-if-reference-player/index.html 3. Select any of the test streams and press Load 4. Click the fullscreen button. What is the expected behavior? Video goes fullscreen and continues playing. What went wrong? The renderer crashes due to a failing assert in blink: [1:1:0621/094314.375706:179100644522:FATAL:LayoutBlock.cpp(2124)] Check failed: !curr_box->NeedsLayout(). #0 0x7f6d53eb49a7 base::debug::StackTrace::StackTrace() #1 0x7f6d53ed7666 logging::LogMessage::~LogMessage() #2 0x7f6d5586adde blink::LayoutBlock::CheckPositionedObjectsNeedLayout() #3 0x7f6d558d3389 blink::LayoutObject::CheckBlockPositionedObjectsNeedLayout() #4 0x7f6d5587a768 blink::LayoutBlockFlow::UpdateBlockLayout() #5 0x7f6d5586e936 blink::LayoutBlock::UpdateLayout() #6 0x7f6d5590e655 blink::LayoutView::LayoutContent() #7 0x7f6d5590e99a blink::LayoutView::UpdateLayout() #8 0x7f6d5562d720 blink::FrameView::PerformLayout() #9 0x7f6d5562cece blink::FrameView::UpdateLayout() #10 0x7f6d5562dd2f blink::FrameView::ScrollbarExistenceDidChange() #11 0x7f6d5562dea0 blink::FrameView::AdjustScrollbarExistence() #12 0x7f6d5562e03e blink::FrameView::UpdateScrollbars() #13 0x7f6d5562e156 blink::FrameView::SetScrollbarModes() #14 0x7f6d5562d178 blink::FrameView::UpdateLayout() #15 0x7f6d5562ed8e blink::FrameView::UpdateStyleAndLayoutIfNeededRecursiveInternal() #16 0x7f6d5562f074 blink::FrameView::UpdateStyleAndLayoutIfNeededRecursive() #17 0x7f6d5562f1f2 blink::FrameView::UpdateLifecyclePhasesInternal() #18 0x7f6d5590e4c2 blink::LayoutView::HitTest() #19 0x7f6d557b6035 blink::EventHandler::HoverTimerFired() #20 0x7f6d550fcea3 blink::TimerBase::RunInternal() #21 0x7f6d53eb5f70 base::debug::TaskAnnotator::RunTask() #22 0x7f6d55240475 blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue() #23 0x7f6d5524110f blink::scheduler::TaskQueueManager::DoWork() #24 0x7f6d53eb5f70 base::debug::TaskAnnotator::RunTask() #25 0x7f6d53ee3940 base::MessageLoop::RunTask() #26 0x7f6d53ee4f21 base::MessageLoop::DeferOrRunPendingTask() #27 0x7f6d53ee5e6e base::MessageLoop::DoWork() #28 0x7f6d53ee78f2 base::MessagePumpDefault::Run() #29 0x7f6d53ee7111 base::MessageLoop::RunHandler() #30 0x7f6d53f1133b base::RunLoop::Run() #31 0x7f6d561e17ce content::RendererMain() #32 0x7f6d5390f3c6 content::RunZygote() #33 0x7f6d5390f55e content::RunNamedProcessTypeMain() #34 0x7f6d5390f6e9 content::ContentMainRunnerImpl::Run() #35 0x7f6d53eaa1c4 service_manager::Main() #36 0x7f6d5390dc9a content::ContentMain() #37 0x0000004006d3 main Crashed report ID: How much crashed? Just one tab Is it a problem with a plugin? No Did this work before? N/A Chrome version: 61.0.3137.0 Channel: dev OS Version: 4.9.33 Flash Version: The crash happens also happens in at least chromium 59 and 58. The attached minimal TC can be also used to reproduce the problem. Removing the -webkit-full-screen from the CSS solves the problem.
,
Jun 21 2017
EventHandler::HoverTimerFired() is triggered by EventHandler::ScheduleHoverStateUpdate() which is called by Fullscreen::FullscreenElementChanged. Adding xun.sun who added those bits in https://chromium.googlesource.com/chromium/src/+/3f160a4573fe250ef407d14ad165d3311cb660b2, could you take a look at this?
,
Jun 21 2017
OK, looks like that email is no longer active. And I see that this started happening with 61.0.3137.0, not the UserAgent at the top. That's when https://chromium-review.googlesource.com/521162 landed, so this is almost certainly a regression I've caused.
,
Jun 22 2017
I missed "The crash happens also happens in at least chromium 59 and 58" and have confirmed that it happens right before https://chromium-review.googlesource.com/521162 as well. Will see if it repros on M57.
,
Jun 22 2017
I've tried and failed to build debug versions of Chrome from commit 4626de7927e6a1a37ab024e39bd6f336032b9fbd (Jan 18) and since this wasn't a regression caused by me, I'll set it back to available.
,
Jun 22 2017
(To make progress on this, one could either bisect debug builds, assuming one can find a version that builds and doesn't repo the failed DCHECK, or just try to understand the code and why it's failing.)
,
Jul 26 2017
Change |position: fixed;| to |position: absolute;| and the bug doesn't reproduce.
,
Jul 25
Tested ToT with dchecks on. Cannot reproduce anymore. Closing stale issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by hu...@opera.com
, Jun 21 2017Components: Blink>Fullscreen Blink>Layout
Summary: Layouting DCHECK when dashif.org's player goes fullscreen (was: Failing assert in blink on dash.js player)