New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 890245 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Regression: Chrome crash is seen on when we continuously increase the display resolution and rest back to normal size

Project Member Reported by rkalavakuntla@chromium.org, Sep 28

Issue description

Chrome Version:71.0.3562.0/11106.0.0 dev channel  Blaze,Candy,Paine
OS: Chrome OS

What steps will reproduce the problem?
(1)Sign into user >> Launch Chrome,minimize the window
(2)Place the mouse pointer on the Chrome icon pinned to shelf 
(3)Now continuously increase the display resolution(press Ctrl+shift+(+)) and rest back(press Ctrl+shift+0) and observe chrome crashes

Actual: Chrome crash is seen on when we continuously increase the display resolution and rest back to  normal size
Expected: Chrome shouldn't get crash

This is a Regression issue as same is working fine in 70.0.3538.22/11021.19.0 beta channel and 71.0.3544.0/11061.0.0 dev


Crash Ids:
----------
dfafd3464169fcaa
4346b79de17bc41e
4c60bff80559e020
a13bf9a2ca5aca69

Link to the list of builds:
---------------------------
https://crash.corp.google.com/browse?q=product_name%3D%27Chrome_ChromeOS%27++AND+expanded_custom_data.ChromeCrashProto.ptype%3D%27browser%27+AND+expanded_custom_data.ChromeCrashProto.magic_signature_1.name%3D%27ui%3A%3ALayer%3A%3AOnDeviceScaleFactorChanged%27


Issue seems to be related to https://chromium-review.googlesource.com/c/chromium/src/+/1222607

@fsamuel:Could you please take a look into this issue and confirm whether it is related to your change,if not please help us in reassigning to its right owner.
Thank you!




 
Crash.mp4
11.5 MB View Download
Stack Trace:
------------
Thread 0 (id: 0x3e8) CRASHED [SIGILL / ILL_ILLOPN @ 0x00005c39c245c81e ] MAGIC SIGNATURE THREAD
Stack Quality100%Show frame trust levels
0x00005c39c245c81e	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/compositor/layer.cc:963 )	ui::Layer::OnDeviceScaleFactorChanged(float)
0x00005c39c245c7dc	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/compositor/layer.cc:967 )	ui::Layer::OnDeviceScaleFactorChanged(float)
0x00005c39c245c7dc	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/compositor/layer.cc:967 )	ui::Layer::OnDeviceScaleFactorChanged(float)
0x00005c39c245c7dc	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/compositor/layer.cc:967 )	ui::Layer::OnDeviceScaleFactorChanged(float)
0x00005c39c245c7dc	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/compositor/layer.cc:967 )	ui::Layer::OnDeviceScaleFactorChanged(float)
0x00005c39c245c7dc	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/compositor/layer.cc:967 )	ui::Layer::OnDeviceScaleFactorChanged(float)
0x00005c39c245c7dc	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/compositor/layer.cc:967 )	ui::Layer::OnDeviceScaleFactorChanged(float)
0x00005c39c245c7dc	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/compositor/layer.cc:967 )	ui::Layer::OnDeviceScaleFactorChanged(float)
0x00005c39c245c7dc	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/compositor/layer.cc:967 )	ui::Layer::OnDeviceScaleFactorChanged(float)
0x00005c39c24450ca	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/aura/window_tree_host.cc:400 )	aura::WindowTreeHost::OnHostResizedInPixels(gfx::Size const&, viz::LocalSurfaceId const&)
0x00005c39c2446a22	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/aura/window_tree_host_platform.cc:209 )	aura::WindowTreeHostPlatform::OnBoundsChanged(gfx::Rect const&)
0x00005c39be9c3940	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/ozone/platform/drm/host/drm_window_host.cc:81 )	<name omitted>
0x00005c39c3382aea	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/aura/window_tree_host_platform.cc:123 )	non-virtual thunk to ash::AshWindowTreeHostPlatform::SetBoundsInPixels(gfx::Rect const&, viz::LocalSurfaceId const&)
0x00005c39c336f76c	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ash/display/window_tree_host_manager.cc:674 )	ash::WindowTreeHostManager::OnDisplayMetricsChanged(display::Display const&, unsigned int)
0x00005c39c32fd557	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/display/manager/display_manager.cc:2121 )	display::DisplayManager::NotifyMetricsChanged(display::Display const&, unsigned int)
0x00005c39c33026a4	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/display/manager/display_manager.cc:1081 )	display::DisplayManager::UpdateDisplaysWith(std::__1::vector<display::ManagedDisplayInfo, std::__1::allocator<display::ManagedDisplayInfo> > const&)
0x00005c39c3304541	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/display/manager/display_manager.cc:890 )	display::DisplayManager::UpdateDisplays()
0x00005c39c3305bf9	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/display/manager/display_manager.cc:1500 )	display::DisplayManager::UpdateZoomFactor(long, float)
0x00005c39c33064f6	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/display/manager/display_manager.cc:1627 )	display::DisplayManager::ZoomDisplay(long, bool)
0x00005c39c349785f	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ash/accelerators/accelerator_commands.cc:36 )	ash::accelerators::ZoomDisplay(bool)
0x00005c39c33311db	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ash/accelerators/accelerator_controller.cc:1601 )	ash::AcceleratorController::PerformAction(ash::AcceleratorAction, ui::Accelerator const&)
0x00005c39c3332c0e	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ash/accelerators/accelerator_controller.cc:1144 )	ash::AcceleratorController::AcceleratorPressed(ui::Accelerator const&)
0x00005c39c528490c	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/base/accelerators/accelerator_manager.cc:90 )	ui::AcceleratorManager::Process(ui::Accelerator const&)
0x00005c39c550a47e	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/wm/core/accelerator_filter.cc:45 )	wm::AcceleratorFilter::OnKeyEvent(ui::KeyEvent*)
0x00005c39c1bdf46b	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_handler.cc:30 )	ui::EventHandler::OnEvent(ui::Event*)
0x00005c39be0365cc	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_dispatcher.cc:191 )	ui::EventDispatcher::DispatchEventToEventHandlers(std::__1::vector<ui::EventHandler*, std::__1::allocator<ui::EventHandler*> >*, ui::Event*)
0x00005c39c1bdece5	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_dispatcher.cc:127 )	ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)
0x00005c39c52bc8fd	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_processor.cc:57 )	ui::EventProcessor::OnEventFromSource(ui::Event*)
0x00005c39c33714b5	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/aura/window_tree_host.cc:252 )	<name omitted>
0x00005c39c52e4bf4	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/base/ime/input_method_base.cc:176 )	ui::InputMethodBase::DispatchKeyEventPostIME(ui::KeyEvent*, base::OnceCallback<void (bool)>) const
0x00005c39c52e65c2	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/base/ime/input_method_chromeos.cc:461 )	ui::InputMethodChromeOS::ProcessUnfilteredKeyPressEvent(ui::KeyEvent*, base::OnceCallback<void (bool)>)
0x00005c39c52e60d9	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/base/ime/input_method_chromeos.cc:127 )	ui::InputMethodChromeOS::DispatchKeyEvent(ui::KeyEvent*, base::OnceCallback<void (bool)>)
0x00005c39c52e66f6	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/base/ime/input_method_chromeos.cc:180 )	ui::InputMethodChromeOS::DispatchKeyEvent(ui::KeyEvent*)
0x00005c39c243cc11	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/aura/window_event_dispatcher.cc:1093 )	aura::WindowEventDispatcher::PreDispatchKeyEvent(ui::KeyEvent*)
0x00005c39c243c5be	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/aura/window_event_dispatcher.cc:616 )	aura::WindowEventDispatcher::PreDispatchEvent(ui::EventTarget*, ui::Event*)
0x00005c39c1bdec19	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_dispatcher.cc:54 )	ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)
0x00005c39c52bc8fd	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_processor.cc:57 )	ui::EventProcessor::OnEventFromSource(ui::Event*)
0x00005c39c52bcd41	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_source.cc:107 )	ui::EventSource::SendEventToSinkFromRewriter(ui::Event*, ui::EventRewriter const*)
0x00005c39c3382ba0	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/event_source.cc:44 )	ash::AshWindowTreeHostPlatform::DispatchEvent(ui::Event*)
0x00005c39c1be1ac8	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/base/callback.h:99 )	ui::DispatchEventFromNativeUiEvent(ui::Event* const&, base::OnceCallback<void (ui::Event*)>)
0x00005c39be9c3ee3	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/ozone/platform/drm/host/drm_window_host.cc:200 )	<name omitted>
0x00005c39be9c3f8c	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/ozone/platform/drm/host/drm_window_host.cc )	non-virtual thunk to ui::DrmWindowHost::DispatchEvent(ui::Event* const&)
0x00005c39c1bd266b	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/platform/platform_event_source.cc:91 )	ui::PlatformEventSource::DispatchEvent(ui::Event*)
0x00005c39c1f5277e	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/base/callback.h:129 )	ui::KeyboardEvdev::DispatchKey(unsigned int, bool, bool, base::TimeTicks, int)
0x00005c39c1f473a6	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/ui/events/ozone/evdev/event_factory_evdev.cc:218 )	ui::EventFactoryEvdev::DispatchKeyEvent(ui::KeyEventParams const&)
0x00005c39bdfe01b2	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/base/callback.h:99 )	base::MessageLoop::DoWork()
0x00005c39bdfee5e4	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/base/message_loop/message_pump_libevent.cc:210 )	base::MessagePumpLibevent::Run(base::MessagePump::Delegate*)
0x00005c39c0d69ac3	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/base/run_loop.cc:102 )	<name omitted>
0x00005c39c094968f	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/chrome/browser/chrome_browser_main.cc:2083 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x00005c39beecb4bb	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/content/browser/browser_main_loop.cc:1065 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x00005c39beeceb91	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/content/browser/browser_main_runner_impl.cc:161 )	content::BrowserMainRunnerImpl::Run()
0x00005c39beec32dc	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/content/browser/browser_main.cc:47 )	content::BrowserMain(content::MainFunctionParams const&)
0x00005c39c09350e0	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/content/app/content_main_runner_impl.cc:538 )	content::ContentMainRunnerImpl::Run(bool)
0x00005c39c093d02b	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/services/service_manager/embedder/main.cc:472 )	service_manager::Main(service_manager::MainParams const&)
0x00005c39be125ba4	(chrome -./../../../../../../../home/chrome-bot/chrome_root/src/content/app/content_main.cc:19 )	ChromeMain
0x00007ff61c5c5735	(libc-2.23.so -libc-start.c:289 )	__libc_start_main
0x00005c39be115cd8	(chrome + 0x0038dcd8 )	_start
0x00007ffdda58ee37		
Cc: malaykeshav@chromium.org ovanieva@chromium.org weidongg@chromium.org marc...@chromium.org afakhry@chromium.org
This issue is marked RBB, beta is coming soon. CC'ing a few people to help find an owner. Thanks
Cc: -malaykeshav@chromium.org
Owner: malaykeshav@chromium.org
Status: Assigned (was: Untriaged)
Malay, can you please take a look?
Hi Malay, Can you please provide a status update as this is marked as RBB. Thanks
Labels: -ReleaseBlock-Beta -M-71 M-72
This bug is not RBB as it does not have a straight forward repro that the user may encounter. Also this has been happening for quite a few milestones.


Cc: osh...@chromium.org
Labels: Needs-Bisect
Do we have a bisect in 70.0.3538.22/11021.19.0 beta channel and 71.0.3544.0/11061.0.0 dev?

The change linked in #1 is not related to this bug.
Malay, is it possible to deduce what might be broken by looking at the "Source" tab in this report? https://crash.corp.google.com/browse?q=product_name%3D%27Chrome_ChromeOS%27++AND+expanded_custom_data.ChromeCrashProto.ptype%3D%27browser%27+AND+expanded_custom_data.ChromeCrashProto.magic_signature_1.name%3D%27ui%3A%3ALayer%3A%3AOnDeviceScaleFactorChanged%27&stbtiq=&reportid=d73254d0886aacba&index=0#4

In some cases we might be able to guess the cause of the crash without actually being able to repro.
Its hard to say. The bug is caused when a deleted layer or a layer delegate in the hierarchy is triggered for update due to a change in zoom level. But which layer in the hierarchy is hard to find without manual debugging. This happens in multiple scenarios:
 - Changing zoom level in overview mode
 - Changing zoom level when launcher is open
 - This bug.

But its not a consistent repro as can be seen from the video in #1. There is some race condition that causes one of the layer/layer delegate in the hierarchy to be deleted before an update is cascaded.

But I am curious if some layer was added between 70.0.3538.22/11021.19.0 beta channel and 71.0.3544.0/11061.0.0 that is causing this. A bisect would greatly help in that.
Cc: newcomer@chromium.org
@weidong +newcomer
From the video the shelf changes shape from rounded corner to a rect. Is there some layer changes happening here?
The rounded corner issue seems to be related to  bug 886622 .
This is definitely not related to my patch. My patch is Android only.
Cc: manucornet@chromium.org

Sign in to add a comment