New issue
Advanced search Search tips

Issue 800541 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner: ----
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Android , Chrome
Pri: 2
Type: Bug

Blocking:
issue 800527



Sign in to add a comment

[root layer scrolls] RenderFrameHostManagerTest fails

Project Member Reported by skobes@chromium.org, Jan 9 2018

Issue description

The following test fails in the content_browsertests step on three trybots:

  RenderFrameHostManagerTest.CrossProcessPopupInheritsSandboxFlagsWithNoOpener

Trybot links:

https://ci.chromium.org/buildbot/tryserver.chromium.chromiumos/linux-chromeos-rel/34722
https://ci.chromium.org/buildbot/tryserver.chromium.android/android_n5x_swarming_rel/336788
https://ci.chromium.org/buildbot/tryserver.chromium.android/linux_android_rel_ng/464058

On linux-chromeos-rel the output includes:

Received signal 11 SEGV_MAPERR 000000000100
#0 0x000002a5ccdc base::debug::StackTrace::StackTrace()
#1 0x000002a5c7d1 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f0983e75330 <unknown>
#3 0x00000420828e blink::GraphicsLayer::AddChildInternal()
#4 0x0000042081f4 blink::GraphicsLayer::SetChildren()
#5 0x000004dc6307 blink::CompositedLayerMapping::SetSublayers()
#6 0x000004dcdfa4 blink::PaintLayerCompositor::AttachFrameContentLayersToIframeLayer()
#7 0x000004dbf50a blink::CompositedLayerMapping::UpdateGraphicsLayerConfiguration()
#8 0x000004dfb191 blink::GraphicsLayerUpdater::UpdateRecursive()
#9 0x000004dfb314 blink::GraphicsLayerUpdater::UpdateRecursive()
#10 0x000004dfb314 blink::GraphicsLayerUpdater::UpdateRecursive()
#11 0x000004dfb025 blink::GraphicsLayerUpdater::Update()
#12 0x000004dcc1b7 blink::PaintLayerCompositor::UpdateIfNeeded()
#13 0x000004dcb9bc blink::PaintLayerCompositor::UpdateIfNeededRecursiveInternal()
#14 0x000004dcb8c6 blink::PaintLayerCompositor::UpdateIfNeededRecursiveInternal()
#15 0x000004dcb466 blink::PaintLayerCompositor::UpdateIfNeededRecursive()
#16 0x00000477dfb5 blink::LocalFrameView::UpdateLifecyclePhasesInternal()
#17 0x00000477dc9a blink::LocalFrameView::UpdateAllLifecyclePhases()
#18 0x000004d16afe blink::PageAnimator::UpdateAllLifecyclePhases()
#19 0x0000046e5b32 blink::WebViewImpl::UpdateAllLifecyclePhases()
#20 0x000005eebf13 blink::WebViewFrameWidget::UpdateAllLifecyclePhases()
#21 0x000005602e21 content::RenderWidget::UpdateVisualState()
#22 0x000003c1fadd cc::ProxyMain::BeginMainFrame()
[...]
BrowserTestBase received signal: Segmentation fault.
 

Comment 1 by bokan@chromium.org, Jan 17 2018

I've minimized a repro that can be run in the browser at: http://bokand.github.io/bugs/800541/index.html

The crash reproduces only on Android, I'm guessing due to more aggressive compositing - I haven't tried very hard to get it to happen on desktop (ChromeOS too has --enable-prefer-compositing-to-lcd-text).

It looks like we haven't yet created a GraphicsLayer for the root layer when we try to attach it to the iframe in the parent. Calling RootLayer()->EnsureCompositedLayerMapping() at AttachFrameContentLayersToIframeLayer fixes the issue, going to run it through the bots.
Project Member

Comment 2 by bugdroid1@chromium.org, Jan 17 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/118e3d9bc198721e3f6eb55cb6897a84498f032d

commit 118e3d9bc198721e3f6eb55cb6897a84498f032d
Author: David Bokan <bokan@chromium.org>
Date: Wed Jan 17 20:36:04 2018

Ensure child frame has root GraphicsLayer on attach

With root-layer-scrolling, the PaintLayerCompositor doesn't create any
GraphicsLayers of its own. Instead, the root graphics layer in a frame
will be the LayoutView's. However, there are cases where the
GraphicsLayer for a subframe wont yet have been created at the time the
parent tries to attach the iframe's layer to the root of its content
document. This doesn't happen when RLS is disabled because the
PaintLayerCompositor would already have created its root layer
(overflow_controls_host_layer).

This CL simply calls EnsureCompositedLayerMapping on the child
LayoutView's PaintLayer, ensuring that we create a GraphicsLayer we can
attach to.

TESTED=In runtime_enabled_features.json5 set RootLayerScrolling to
`status: "stable"`. Run `content_browsertests
--gtest_filter=*CrossProcessPopupInheritsSandboxFlagsWithNoOpener`

Bug:  800541 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I19b4f423328bbd59ad8be0076959a9137c6fdb9c
Reviewed-on: https://chromium-review.googlesource.com/870994
Commit-Queue: David Bokan <bokan@chromium.org>
Reviewed-by: Steve Kobes <skobes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#529863}
[modify] https://crrev.com/118e3d9bc198721e3f6eb55cb6897a84498f032d/third_party/WebKit/Source/core/paint/compositing/PaintLayerCompositor.cpp

Comment 3 by bokan@chromium.org, Jan 18 2018

Status: Fixed (was: Available)

Comment 4 by bokan@chromium.org, Jan 18 2018

 Issue 800561  has been merged into this issue.

Sign in to add a comment