New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 810619 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

DCHECK crash when dialog is shown on print preview of a PDF

Project Member Reported by rbpotter@chromium.org, Feb 9 2018

Issue description

Chrome Version: 66.0.3341.0 (Developer Build) (64-bit)
OS: Linux, have not tried others

What steps will reproduce the problem?
1. Run with DCHECKs on
2. Open a PDF, e.g. https://www.irs.gov/pub/irs-prior/f1040ez--2017.pdf
3. Open Print Preview
4. Open dev tools for print preview page, and ensure the selected element is not inside the preview area iframe.
5. Execute the following lines in the console:
let di = document.createElement('dialog');
document.body.appendChild(di);
di.showModal()

What is the expected result?
Empty modal dialog should appear on print preview page.

What happens instead?
DCHECK crash. Trace pasted below.

Note - this does not occur on print previews of webpages (e.g. www.google.com). Also does not occur if an element of the preview area iframe is selected in dev tools, for example, the plugin embed element.

Trace: 
[1:1:0208/163026.850222:FATAL:FindPropertiesNeedingUpdate.h(91)] Check failed: !!original_scroll_node_ == !!frame_view_->ScrollNode(). Property was created or deleted without the LocalFrameView needing a paint property update.
Original:
 0x371596d84fd0 {"parent":"0x371596d84310","containerRect":"0,0 1319x710","contentsRect":"0,0 1319x3560","userScrollable":"both","compositorElementId":"(610)"}
Updated:
null
#0 0x7fcfd2458a7d base::debug::StackTrace::StackTrace()
#1 0x7fcfd2456f6c base::debug::StackTrace::StackTrace()
#2 0x7fcfd24df99a logging::LogMessage::~LogMessage()
#3 0x7fcfc04d2646 blink::FindFrameViewPropertiesNeedingUpdateScope::~FindFrameViewPropertiesNeedingUpdateScope()
#4 0x7fcfc04c85c0 blink::FrameViewPaintPropertyTreeBuilder::Update()
#5 0x7fcfc04f5f3f blink::PrePaintTreeWalk::Walk()
#6 0x7fcfc04f64f5 blink::PrePaintTreeWalk::Walk()
#7 0x7fcfc04f62e2 blink::PrePaintTreeWalk::Walk()
#8 0x7fcfc04f62e2 blink::PrePaintTreeWalk::Walk()
#9 0x7fcfc04f62e2 blink::PrePaintTreeWalk::Walk()
#10 0x7fcfc04f62e2 blink::PrePaintTreeWalk::Walk()
#11 0x7fcfc04f62e2 blink::PrePaintTreeWalk::Walk()
#12 0x7fcfc04f62e2 blink::PrePaintTreeWalk::Walk()
#13 0x7fcfc04f60d2 blink::PrePaintTreeWalk::Walk()
#14 0x7fcfc04f5c01 blink::PrePaintTreeWalk::Walk()
#15 0x7fcfbfb3bcf7 blink::LocalFrameView::PrePaint()
#16 0x7fcfbfb3a288 blink::LocalFrameView::UpdateLifecyclePhasesInternal()
#17 0x7fcfbfb39922 blink::LocalFrameView::UpdateAllLifecyclePhases()
#18 0x7fcfc03e5a2b blink::PageAnimator::UpdateAllLifecyclePhases()
#19 0x7fcfc03eae2c blink::PageWidgetDelegate::UpdateLifecycle()
#20 0x7fcfbfa5d318 blink::WebViewImpl::UpdateLifecycle()
#21 0x7fcfbfbce4b7 blink::WebViewFrameWidget::UpdateLifecycle()
#22 0x7fcfcdca95fb content::RenderWidget::UpdateVisualState()
#23 0x7fcfcda97a03 content::RenderWidgetCompositor::UpdateLayerTreeHost()
#24 0x7fcfc9e2e793 cc::LayerTreeHost::RequestMainFrameUpdate()
#25 0x7fcfc9f1efa0 cc::ProxyMain::BeginMainFrame()



 
Cc: aboxhall@chromium.org hayato@chromium.org kochi@chromium.org falken@chromium.org dmazz...@chromium.org
Components: Blink>HTML>Dialog
Labels: Stability-Crash
CC'ing a few people who might have some insight. Also cc'ed hayato@ just in case this is related to  issue 804047 , but I don't think so since this repro does not include any user-defined Shadow DOM.
Thanks. I'm afraid that we don't have an active owner of <dialog>.
I guess falken@ is no longer working on <dialog> yet.

I appreciate if someone can take a look at <dialog>.
If my understanding is incorrect, please let us know.
Components: -Blink Blink>Paint
Owner: wangxianzhu@chromium.org
Status: Assigned (was: Untriaged)
I'm curious: What happens with DCHECK off? Do we crash for some other reason?
I tested in Canary (66.0.3344.0) on Windows 10 and the dialog shows up as expected, so as far as I can tell there is no crash if DCHECKS are off. 
Can you try --root-layer-scrolls? If it doesn't crash, then we'll probably not fix this bug because the feature will be eneabled by default in M66.
Comment 6: it does not crash with that flag, thanks. Is the feature going to be enabled on ToT soon also?
Yes, hopefully it will be enabled on ToT before m66 branch.
Status: Fixed (was: Assigned)
--root-layer-scrolls and --enable-slimming-paint-v175 have been enabled on ToT.

Sign in to add a comment