New issue
Advanced search Search tips

Issue 804886 link

Starred by 3 users
Status: Fixed
Owner:
changwan@chromium.org
Closed: Jan 2018
Cc:
michaelbai@chromium.org
changwan@chromium.org
rogerm@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 1
Type: Bug-Regression



Sign in to add a comment

AndroidWebView: blink::Document::UpdateStyleAndLayoutTreeIgnorePendingStylesheets

Project Member Reported by acindhe@chromium.org, Jan 23 2018 
First seen in 59.0.3071.125
Number of reports : 69 ( Its a top crash Rank 1/10) 

Crash link:
https://crash.corp.google.com/browse?q=product.name%3D%27AndroidWebView%27%20AND%20product.version%3D%2765.0.3322.0%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27blink%3A%3ADocument%3A%3AUpdateStyleAndLayoutTreeIgnorePendingStylesheets%27&sql_dialect=googlesql&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D

-------------------------------------------------------------------------------
Sample Report
-------------------------------------------------------------------------------
Product name: Androidwebview
Magic Signature : blink::Document::UpdateStyleAndLayoutTreeIgnorePendingStylesheets
Product Version: 65.0.3322.0
Report ID: a0afd2da2fcb12bf
Report Url: https://crash.corp.google.com/browse?stbtiq=a0afd2da2fcb12bf

-------------------------------------------------------------------------------
Crashing thread:  Stack Quality: 71%. Thread id : 21023.
-------------------------------------------------------------------------------
0xe0749b9a	(libmonochrome.so -Document.cpp:2458 )	blink::Document::UpdateStyleAndLayoutTreeIgnorePendingStylesheets()
0xe0749add	(libmonochrome.so -Document.cpp:2491 )	blink::Document::UpdateStyleAndLayoutIgnorePendingStylesheets(blink::Document::RunPostLayoutTasks)
0xe09239ff	(libmonochrome.so -WebNode.cpp:137 )	blink::WebNode::IsFocusable() const
0xe091f6b1	(libmonochrome.so -form_autofill_util.cc:1413 )	autofill::form_util::WebFormControlElementToFormField(blink::WebFormControlElement const&, std::__ndk1::map<blink::WebFormControlElement const, std::__ndk1::pair<std::__ndk1::unique_ptr<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> >, std::__ndk1::default_delete<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > > >, unsigned int>, std::__ndk1::less<blink::WebFormControlElement const>, std::__ndk1::allocator<std::__ndk1::pair<blink::WebFormControlElement const, std::__ndk1::pair<std::__ndk1::unique_ptr<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> >, std::__ndk1::default_delete<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > > >, unsigned int> > > > const*, autofill::form_util::ExtractMask, autofill::FormFieldData*)
0xe091eedb	(libmonochrome.so -form_autofill_util.cc:964 )	autofill::form_util::(anonymous namespace)::FormOrFieldsetsToFormData(blink::WebFormElement const*, blink::WebFormControlElement const*, std::__ndk1::vector<blink::WebElement, std::__ndk1::allocator<blink::WebElement> > const&, blink::WebVector<blink::WebFormControlElement> const&, std::__ndk1::map<blink::WebFormControlElement const, std::__ndk1::pair<std::__ndk1::unique_ptr<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> >, std::__ndk1::default_delete<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > > >, unsigned int>, std::__ndk1::less<blink::WebFormControlElement const>, std::__ndk1::allocator<std::__ndk1::pair<blink::WebFormControlElement const, std::__ndk1::pair<std::__ndk1::unique_ptr<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> >, std::__ndk1::default_delete<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > > >, unsigned int> > > > const*, autofill::form_util::ExtractMask, autofill::FormData*, autofill::FormFieldData*)
0xe091ed15	(libmonochrome.so -form_autofill_util.cc:1501 )	autofill::form_util::WebFormElementToFormData(blink::WebFormElement const&, blink::WebFormControlElement const&, std::__ndk1::map<blink::WebFormControlElement const, std::__ndk1::pair<std::__ndk1::unique_ptr<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> >, std::__ndk1::default_delete<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > > >, unsigned int>, std::__ndk1::less<blink::WebFormControlElement const>, std::__ndk1::allocator<std::__ndk1::pair<blink::WebFormControlElement const, std::__ndk1::pair<std::__ndk1::unique_ptr<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> >, std::__ndk1::default_delete<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > > >, unsigned int> > > > const*, autofill::form_util::ExtractMask, autofill::FormData*, autofill::FormFieldData*)
0xe1a795d3	(libmonochrome.so -form_autofill_util.cc:1660 )	autofill::form_util::FindFormAndFieldForFormControlElement(blink::WebFormControlElement const&, autofill::FormData*, autofill::FormFieldData*)
0xe1a77f89	(libmonochrome.so -autofill_agent.cc:218 )	autofill::AutofillAgent::DidChangeScrollOffset()
0xe20da7d9	(libmonochrome.so -render_frame_impl.cc:5032 )	content::RenderFrameImpl::DidChangeScrollOffset()
0xe1cc9ae9	(libmonochrome.so -LocalFrameView.cpp:4273 )	blink::LocalFrameView::DidChangeScrollOffset()
0xe1cc9a91	(libmonochrome.so -LocalFrameView.cpp:4257 )	blink::LocalFrameView::UpdateScrollOffset(blink::FloatSize const&, blink::ScrollType)
0xe164cc71	(libmonochrome.so -ScrollableArea.cpp:294 )	blink::ScrollableArea::ScrollOffsetChanged(blink::FloatSize const&, blink::ScrollType)
0xe070df1f	(libmonochrome.so -ScrollableArea.cpp:191 )	blink::ScrollableArea::SetScrollOffset(blink::FloatSize const&, blink::ScrollType, blink::ScrollBehavior)
0xe07040c3	(libmonochrome.so -LocalFrameView.cpp:4549 )	blink::LocalFrameView::AdjustScrollOffsetFromUpdateScrollbars()
0xe070d1a3	(libmonochrome.so -LocalFrameView.cpp:1615 )	blink::LocalFrameView::ViewportSizeChanged(bool, bool)
0xe070d12f	(libmonochrome.so -LocalFrameView.cpp:604 )	blink::LocalFrameView::SetFrameRect(blink::IntRect const&)
0xe070d0a5	(libmonochrome.so -LocalFrameView.h:133 )	blink::LocalFrameView::Resize(blink::IntSize const&)
0xe070d025	(libmonochrome.so -ResizeViewportAnchor.cpp:24 )	blink::ResizeViewportAnchor::ResizeFrameView(blink::IntSize const&)
0xe070cac3	(libmonochrome.so -WebViewImpl.cpp:3407 )	blink::WebViewImpl::ResizeAfterLayout()
0xe070c7f9	(libmonochrome.so -LayoutView.cpp:816 )	blink::LayoutView::UpdateAfterLayout()
0xe0704f9b	(libmonochrome.so -LayoutBlockFlow.cpp:512 )	blink::LayoutBlockFlow::UpdateBlockLayout(bool)
0xe0704ce1	(libmonochrome.so -LayoutView.cpp:284 )	blink::LayoutView::UpdateBlockLayout(bool)
0xe0704b49	(libmonochrome.so -LayoutBlock.cpp:428 )	blink::LayoutBlock::UpdateLayout()
0xe0704a55	(libmonochrome.so -LayoutView.cpp:316 )	blink::LayoutView::UpdateLayout()
0xe070436b	(libmonochrome.so -LocalFrameView.cpp:1068 )	blink::LocalFrameView::PerformLayout(bool)
0xe06ccddd	(libmonochrome.so -LocalFrameView.cpp:1253 )	blink::LocalFrameView::UpdateStyleAndLayoutIfNeededRecursiveInternal()
0xe06ccb0f	(libmonochrome.so -LocalFrameView.cpp:3407 )	blink::LocalFrameView::UpdateStyleAndLayoutIfNeededRecursive()
0xe06cc8bf	(libmonochrome.so -LocalFrameView.cpp:3149 )	blink::LocalFrameView::UpdateLifecyclePhasesInternal(blink::DocumentLifecycle::LifecycleState)
0xe06cc83f	(libmonochrome.so -PageAnimator.cpp:100 )	blink::PageAnimator::UpdateAllLifecyclePhases(blink::LocalFrame&)
0xe06cc6e5	(libmonochrome.so -WebViewImpl.cpp:1853 )	blink::WebViewImpl::UpdateAllLifecyclePhases()
0xe06ca23f	(libmonochrome.so -WebViewImpl.cpp:1739 )	blink::WebViewImpl::ResizeViewWhileAnchored(float, float, bool)
0xe06c3799	(libmonochrome.so -WebViewImpl.cpp:1795 )	blink::WebViewImpl::ResizeWithBrowserControls(blink::WebSize const&, float, float, bool)
0xe06c35d3	(libmonochrome.so -render_view_impl.cc:2055 )	content::RenderViewImpl::ResizeWebWidget()
0xe06c335f	(libmonochrome.so -render_widget.cc:1351 )	content::RenderWidget::Resize(content::ResizeParams const&)
0xe06c3195	(libmonochrome.so -render_widget.cc:801 )	content::RenderWidget::OnResize(content::ResizeParams const&)
0xe06c30f3	(libmonochrome.so -render_view_impl.cc:2081 )	content::RenderViewImpl::OnResize(content::ResizeParams const&)
0xe04493d5	(libmonochrome.so -tuple.h:60 )	void IPC::DispatchToMethod<ChromeRenderMessageFilter, void (ChromeRenderMessageFilter::*)(network_hints::LookupRequest const&), void, std::__ndk1::tuple<network_hints::LookupRequest> >(ChromeRenderMessageFilter*, void (ChromeRenderMessageFilter::*)(network_hints::LookupRequest const&), void*, std::__ndk1::tuple<network_hints::LookupRequest>&&)
0xe06ca149	(libmonochrome.so -ipc_message_templates.h:146 )	bool IPC::MessageT<ViewMsg_Resize_Meta, std::__ndk1::tuple<content::ResizeParams>, void>::Dispatch<content::RenderWidget, content::RenderWidget, void, void (content::RenderWidget::*)(content::ResizeParams const&)>(IPC::Message const*, content::RenderWidget*, content::RenderWidget*, void*, void (content::RenderWidget::*)(content::ResizeParams const&))
0xe06c7095	(libmonochrome.so -render_widget.cc:667 )	content::RenderWidget::OnMessageReceived(IPC::Message const&)
0xe06c6cbb	(libmonochrome.so -render_view_impl.cc:1158 )	content::RenderViewImpl::OnMessageReceived(IPC::Message const&)
0xe067dfd9	(libmonochrome.so -child_thread_impl.cc:366 )	content::ChildThreadImpl::ChildThreadMessageRouter::RouteMessage(IPC::Message const&)
0xe067de37	(libmonochrome.so -ipc_channel_proxy.cc:320 )	IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&)
0xe0304b27	(libmonochrome.so -callback.h:65 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0xe09c302b	(libmonochrome.so -task_queue_manager.cc:519 )	blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(blink::scheduler::internal::WorkQueue*, blink::scheduler::LazyNow, base::TimeTicks*)
0xe09c23a7	(libmonochrome.so -task_queue_manager.cc:330 )	blink::scheduler::TaskQueueManager::DoWork(blink::scheduler::internal::Sequence::WorkType)
0xe0304b27	(libmonochrome.so -callback.h:65 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0xe09c2153	(libmonochrome.so -thread_controller_impl.cc:99 )	blink::scheduler::internal::ThreadControllerImpl::DoWork(blink::scheduler::internal::Sequence::WorkType)
0xe0304b27	(libmonochrome.so -callback.h:65 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0xe03046c3	(libmonochrome.so -message_loop.cc:399 )	base::MessageLoop::RunTask(base::PendingTask*)
0xe049b4cb	(libmonochrome.so -message_loop.cc:411 )	base::MessageLoop::DoWork()
0xe05927df	(libmonochrome.so -message_pump_default.cc:37 )	base::MessagePumpDefault::Run(base::MessagePump::Delegate*)
0xe049b23f	(libmonochrome.so -run_loop.cc:130 )	base::RunLoop::Run()
0xe064580d	(libmonochrome.so -renderer_main.cc:218 )	content::RendererMain(content::MainFunctionParams const&)
0xe02fc8b1	(libmonochrome.so -content_main_runner.cc:720 )	content::ContentMainRunnerImpl::Run()
0xe02f2e6f	(libmonochrome.so -main.cc:456 )	service_manager::Main(service_manager::MainParams const&)
0xe02f2b11	(libmonochrome.so -content_main.cc:42 )	Java_org_chromium_content_app_ContentMain_nativeStart

Comment 1 by acindhe@chromium.org, Jan 23 2018 

Seen from : 59.0.3071.125. 

Crash found on top devices are:
taimen - 11 reports
sailfish - 11 reports
marlin - 9 reports

Comment 2 by boliu@chromium.org, Jan 23 2018

Labels: ReleaseBlock-Stable
Owner: michaelbai@chromium.org
Status: Assigned (was: Untriaged)
Autofill crash

Comment 3 by michaelbai@chromium.org, Jan 23 2018

Cc: michaelbai@chromium.org
Owner: changwan@chromium.org
same as b/71709016 , but it shouldn't be seen in M59.

Comment 4 by michaelbai@chromium.org, Jan 23 2018

Cc: rogerm@chromium.org
Components: UI>Browser>Autofill

Comment 5 by boliu@chromium.org, Jan 23 2018 

This is the number 1 signature on 65 dev though. Given autofill isn't even rolled out that widely (being O-only?), this is pretty concerning.

Comment 6 by changwan@chromium.org, Jan 23 2018

Status: Started (was: Assigned)
I'm on it.

Comment 7 by satyavat...@chromium.org, Jan 24 2018

Labels: -M-65 M-64
Marking as M64 RBS, since it is affecting M64. It is regression in M64. 
As a note: Crash report shows it happening from M59. 59.0.3071.125 which is not correct though!
Project Member

Comment 10 by bugdroid1@chromium.org, Jan 24 2018 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9db32db4d0cd5633d6d76d77ac74288d6d528cad

commit 9db32db4d0cd5633d6d76d77ac74288d6d528cad
Author: Changwan Ryu <changwan@chromium.org>
Date: Wed Jan 24 14:54:44 2018

[WebView Autofill] Post DidChangeScrollOffset outside PerformLayout

If LocalFrameView::PerformLayout() ends up calling
LocalFrameView::ViewportSizeChanged(), then
it may in turn call AutofillAgent::DidChangeScrollOffset().

However, FindFormAndFieldForFormControlElement() and
ElementBoundsInWindow() requires that document life cycle to be
mutatable (and thus not in the middle of perform layout).

Therefore, posting a task to delay calling these functions outside
PerformLayout().

Note that this uses a similar mechanism as
FormTracker::TextFieldDidChange().

BUG= 804886 

Change-Id: Ibe6e6d9921185f075d16c6c955d45d17ad490fd5
Reviewed-on: https://chromium-review.googlesource.com/882664
Reviewed-by: Mathieu Perreault <mathp@chromium.org>
Commit-Queue: Changwan Ryu <changwan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#531528}
[modify] https://crrev.com/9db32db4d0cd5633d6d76d77ac74288d6d528cad/components/autofill/content/renderer/autofill_agent.cc
[modify] https://crrev.com/9db32db4d0cd5633d6d76d77ac74288d6d528cad/components/autofill/content/renderer/autofill_agent.h

Comment 11 by changwan@chromium.org, Jan 24 2018

Labels: Merge-Request-65 Merge-Request-64 Type-Bug-Regression
Project Member

Comment 12 by sheriffbot@chromium.org, Jan 24 2018

Labels: -Merge-Request-64 Hotlist-Merge-Review Merge-Review-64
This bug requires manual review: Request affecting a post-stable build
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), kbleicher@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 13 by cma...@chromium.org, Jan 24 2018

Labels: -Hotlist-Merge-Review -Merge-Review-64 -Merge-Request-65 Merge-Approved-64 Merge-Approved-65
Project Member

Comment 14 by bugdroid1@chromium.org, Jan 24 2018

Labels: -merge-approved-65 merge-merged-3325
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b609600f247417dc14b60b985c5981a04f93ea2c

commit b609600f247417dc14b60b985c5981a04f93ea2c
Author: Changwan Ryu <changwan@chromium.org>
Date: Wed Jan 24 19:34:32 2018

[WebView Autofill] Post DidChangeScrollOffset outside PerformLayout

If LocalFrameView::PerformLayout() ends up calling
LocalFrameView::ViewportSizeChanged(), then
it may in turn call AutofillAgent::DidChangeScrollOffset().

However, FindFormAndFieldForFormControlElement() and
ElementBoundsInWindow() requires that document life cycle to be
mutatable (and thus not in the middle of perform layout).

Therefore, posting a task to delay calling these functions outside
PerformLayout().

Note that this uses a similar mechanism as
FormTracker::TextFieldDidChange().

BUG= 804886 

Change-Id: Ibe6e6d9921185f075d16c6c955d45d17ad490fd5
Reviewed-on: https://chromium-review.googlesource.com/882664
Reviewed-by: Mathieu Perreault <mathp@chromium.org>
Commit-Queue: Changwan Ryu <changwan@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#531528}(cherry picked from commit 9db32db4d0cd5633d6d76d77ac74288d6d528cad)
Reviewed-on: https://chromium-review.googlesource.com/884265
Reviewed-by: Changwan Ryu <changwan@chromium.org>
Cr-Commit-Position: refs/branch-heads/3325@{#68}
Cr-Branched-From: bc084a8b5afa3744a74927344e304c02ae54189f-refs/heads/master@{#530369}
[modify] https://crrev.com/b609600f247417dc14b60b985c5981a04f93ea2c/components/autofill/content/renderer/autofill_agent.cc
[modify] https://crrev.com/b609600f247417dc14b60b985c5981a04f93ea2c/components/autofill/content/renderer/autofill_agent.h
Project Member

Comment 15 by bugdroid1@chromium.org, Jan 24 2018

Labels: -merge-approved-64 merge-merged-3282
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/aaa26cf2b9ef3126948873edc8603a4c67aa3af1

commit aaa26cf2b9ef3126948873edc8603a4c67aa3af1
Author: Changwan Ryu <changwan@chromium.org>
Date: Wed Jan 24 21:39:45 2018

[WebView Autofill] Post DidChangeScrollOffset outside PerformLayout

If LocalFrameView::PerformLayout() ends up calling
LocalFrameView::ViewportSizeChanged(), then
it may in turn call AutofillAgent::DidChangeScrollOffset().

However, FindFormAndFieldForFormControlElement() and
ElementBoundsInWindow() requires that document life cycle to be
mutatable (and thus not in the middle of perform layout).

Therefore, posting a task to delay calling these functions outside
PerformLayout().

Note that this uses a similar mechanism as
FormTracker::TextFieldDidChange().

BUG= 804886 

(cherry picked from commit 9db32db4d0cd5633d6d76d77ac74288d6d528cad)

Change-Id: Ibe6e6d9921185f075d16c6c955d45d17ad490fd5
Reviewed-on: https://chromium-review.googlesource.com/882664
Reviewed-by: Mathieu Perreault <mathp@chromium.org>
Commit-Queue: Changwan Ryu <changwan@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#531528}
Reviewed-on: https://chromium-review.googlesource.com/884504
Reviewed-by: Changwan Ryu <changwan@chromium.org>
Cr-Commit-Position: refs/branch-heads/3282@{#593}
Cr-Branched-From: 5fdc0fab22ce7efd32532ee989b223fa12f8171e-refs/heads/master@{#520840}
[modify] https://crrev.com/aaa26cf2b9ef3126948873edc8603a4c67aa3af1/components/autofill/content/renderer/autofill_agent.cc
[modify] https://crrev.com/aaa26cf2b9ef3126948873edc8603a4c67aa3af1/components/autofill/content/renderer/autofill_agent.h

Comment 16 by changwan@chromium.org, Jan 24 2018

Status: Fixed (was: Started)

Comment 18 by aluo@chromium.org, Feb 23 2018

Cc: changwan@chromium.org
 Issue 815012  has been merged into this issue.

Comment 19 by changwan@chromium.org, Apr 4 2018

Labels: -Restrict-View-Google

Comment 20 by changwan@chromium.org, Apr 4 2018 

Removing RVG as crash URLs are the only things that are google proprietary, and some OEMs inquired about this.
►

Sign in to add a comment