Issue 530623 in chromium: WebView crashing in content::ContentViewCoreImpl::OnSelectionEvent

140 views
Skip to first unread message

chro...@googlecode.com

unread,
Sep 11, 2015, 11:43:58 AM9/11/15
to chromi...@chromium.org
Status: Untriaged
Owner: ----
Labels: Type-Bug Pri-2 Cr-Mobile-WebView OS-Android

New issue 530623 by to...@chromium.org: WebView crashing in
content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623

Version: 45.0.2454.87
OS: 5.0 and 5.1

Crash extracted from
https://crash.corp.google.com/browse?q=product.name%3D%27AndroidWebView%27%20AND%20stable_signature%3D%27base%3A%3Adebug%3A%3ABreakDebugger-d7e7828d%27%20AND%20product.Version%3D%2745.0.2454.87%27#samplereports

0xa2185bfb (libwebviewchromium.so -debugger_posix.cc:216 )
base::debug::BreakDebugger
0xa2192fa7 (libwebviewchromium.so -logging.cc:639 )
logging::LogMessage::~LogMessage
0xa217f4df (libwebviewchromium.so -jni_android.cc:249 )
base::android::CheckException
0xa25f3be5 (libwebviewchromium.so -jni_generator_helper.h:33 )
content::ContentViewCoreImpl::OnSelectionEvent
0xa271235f (libwebviewchromium.so -render_widget_host_view_android.cc:1276
) content::RenderWidgetHostViewAndroid::OnSelectionEvent
0xa338b84f (libwebviewchromium.so -touch_selection_controller.cc:214 )
ui::TouchSelectionController::HideAndDisallowShowingAutomatically
0xa338bcf5 (libwebviewchromium.so -touch_selection_controller.cc:135 )
ui::TouchSelectionController::OnSelectionBoundsChanged
0xa271257d (libwebviewchromium.so -render_widget_host_view_android.cc:1351
) content::RenderWidgetHostViewAndroid::OnFrameMetadataUpdated
0xa2714e23 (libwebviewchromium.so -render_widget_host_view_android.cc:1213
) content::RenderWidgetHostViewAndroid::SynchronousFrameMetadata
0xa25fa4e3 (libwebviewchromium.so -synchronous_compositor_impl.cc:233 )
content::SynchronousCompositorImpl::UpdateFrameMetaData
0xa25fa54b (libwebviewchromium.so -synchronous_compositor_impl.cc:202 )
content::SynchronousCompositorImpl::DemandDrawHw
0xa20caee5 (libwebviewchromium.so -browser_view_renderer.cc:256 )
android_webview::BrowserViewRenderer::CompositeHw
0xa20cb08b (libwebviewchromium.so -browser_view_renderer.cc:223 )
android_webview::BrowserViewRenderer::OnDrawHardware
0xa20d8afb (libwebviewchromium.so -aw_contents.cc:907 )
android_webview::AwContents::OnDraw

Main app this is happening in is
https://play.google.com/store/apps/details?id=org.lds.ldssa when
selecting/annotating text.

Currently #1 crash on M45, though this may be a statistical anomaly since
it only just rolled to stable :)

--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

chro...@googlecode.com

unread,
Sep 11, 2015, 1:43:03 PM9/11/15
to chromi...@chromium.org

Comment #3 on issue 530623 by jdd...@chromium.org: WebView crashing in
content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623

Hmm, can't seem to repro with 46.0.2490.23 or 45.0.2454.87. In both the
org.lds.ldssa and linkbubble apps it's clear the embedder is doing
something funky with selection. In the ldssa app they override the handles,
in the linkbubble app the selection disappears immediately. Still trying to
repro the crash...

chro...@googlecode.com

unread,
Sep 11, 2015, 2:52:21 PM9/11/15
to chromi...@chromium.org
Updates:
Cc: tobia...@chromium.org

Comment #5 on issue 530623 by jdd...@chromium.org: WebView crashing in
content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623

All of these apps appear to override ActionMode creation/appearance in some
fashion. Looks like we tickled the ActionMode theming in M45
(https://codereview.chromium.org/1216853005). Though, looking at the change
there, if we didn't have issues in M44 I'm not sure that's at fault here.

I also changed how some of the selection clearing code is wired up
(https://codereview.chromium.org/1209713002), which is triggered when the
embedder returns null during ActionMode creation. Why apps
(flynx/linkbubble) do that instead of overriding performLongClick I have no
idea. Anyway, not sure why I wouldn't be able to repro if there was a
problem with that change.

chro...@googlecode.com

unread,
Sep 11, 2015, 3:48:29 PM9/11/15
to chromi...@chromium.org

Comment #6 on issue 530623 by jeffdc...@gmail.com: WebView crashing in
content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623

I'm the lead developer for the org.lds.ldssa app.... We are hearing from a
lot of our users that the app is now crashing... I've spent the better part
of the day trying to isolate the issue. Here is what I have found:
- We can reproduce this issue on any device that has 45.0.2454.87
- I just tried the 46.0.2490.23 version and my initial tests show that this
version does not produce the crash.
- To reproduce the issue simply do the following (no LDS Account is needed)
* Go to content in any book (a place where you see words from a book)
* Long press on a single word (to begin highlight mode)
* Drag the right handle to the right
* (CRASH)

- I get the following stack trace (every time the app crashes):
09-11 12:47:46.400 3932-3932/org.lds.ldssa.dev W/System.err:
java.lang.NullPointerException: Attempt to invoke virtual method 'void
android.view.ActionMode.finish()' on a null object reference
09-11 12:47:46.400 3932-3932/org.lds.ldssa.dev W/System.err: at
org.chromium.content.browser.SelectActionMode.finish(SelectActionMode.java:33)
09-11 12:47:46.400 3932-3932/org.lds.ldssa.dev W/System.err: at
org.chromium.content.browser.ContentViewCore.hideSelectActionMode(ContentViewCore.java:1485)
09-11 12:47:46.400 3932-3932/org.lds.ldssa.dev W/System.err: at
org.chromium.content.browser.ContentViewCore.onSelectionEvent(ContentViewCore.java:2229)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
org.chromium.android_webview.AwContents.nativeOnDraw(Native Method)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
org.chromium.android_webview.AwContents.access$4100(AwContents.java:94)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
org.chromium.android_webview.AwContents$AwViewMethodsImpl.onDraw(AwContents.java:2729)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
org.chromium.android_webview.AwContents.onDraw(AwContents.java:1180)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
com.android.webview.chromium.WebViewChromium.onDraw(WebViewChromium.java:1718)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.webkit.WebView.onDraw(WebView.java:2393)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.draw(View.java:15231)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.updateDisplayListIfDirty(View.java:14167)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.getDisplayList(View.java:14189)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.recreateChildDisplayList(ViewGroup.java:3389)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.dispatchGetDisplayList(ViewGroup.java:3368)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.updateDisplayListIfDirty(View.java:14127)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.getDisplayList(View.java:14189)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.recreateChildDisplayList(ViewGroup.java:3389)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.dispatchGetDisplayList(ViewGroup.java:3368)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.updateDisplayListIfDirty(View.java:14127)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.getDisplayList(View.java:14189)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.recreateChildDisplayList(ViewGroup.java:3389)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.dispatchGetDisplayList(ViewGroup.java:3368)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.updateDisplayListIfDirty(View.java:14127)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.getDisplayList(View.java:14189)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.recreateChildDisplayList(ViewGroup.java:3389)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.dispatchGetDisplayList(ViewGroup.java:3368)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.updateDisplayListIfDirty(View.java:14127)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.getDisplayList(View.java:14189)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.recreateChildDisplayList(ViewGroup.java:3389)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.dispatchGetDisplayList(ViewGroup.java:3368)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.updateDisplayListIfDirty(View.java:14127)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.getDisplayList(View.java:14189)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.recreateChildDisplayList(ViewGroup.java:3389)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.dispatchGetDisplayList(ViewGroup.java:3368)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.updateDisplayListIfDirty(View.java:14127)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.getDisplayList(View.java:14189)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.recreateChildDisplayList(ViewGroup.java:3389)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.dispatchGetDisplayList(ViewGroup.java:3368)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.updateDisplayListIfDirty(View.java:14127)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.getDisplayList(View.java:14189)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.recreateChildDisplayList(ViewGroup.java:3389)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.dispatchGetDisplayList(ViewGroup.java:3368)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.updateDisplayListIfDirty(View.java:14127)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.getDisplayList(View.java:14189)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.recreateChildDisplayList(ViewGroup.java:3389)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.dispatchGetDisplayList(ViewGroup.java:3368)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.updateDisplayListIfDirty(View.java:14127)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.getDisplayList(View.java:14189)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.recreateChildDisplayList(ViewGroup.java:3389)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewGroup.dispatchGetDisplayList(ViewGroup.java:3368)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.updateDisplayListIfDirty(View.java:14127)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.View.getDisplayList(View.java:14189)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ThreadedRenderer.updateViewTreeDisplayList(ThreadedRenderer.java:273)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ThreadedRenderer.updateRootDisplayList(ThreadedRenderer.java:279)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ThreadedRenderer.draw(ThreadedRenderer.java:318)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewRootImpl.draw(ViewRootImpl.java:2530)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewRootImpl.performDraw(ViewRootImpl.java:2352)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewRootImpl.performTraversals(ViewRootImpl.java:1982)
09-11 12:47:46.401 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewRootImpl.doTraversal(ViewRootImpl.java:1061)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.ViewRootImpl$TraversalRunnable.run(ViewRootImpl.java:5885)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.Choreographer$CallbackRecord.run(Choreographer.java:767)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.Choreographer.doCallbacks(Choreographer.java:580)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.Choreographer.doFrame(Choreographer.java:550)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
android.view.Choreographer$FrameDisplayEventReceiver.run(Choreographer.java:753)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
android.os.Handler.handleCallback(Handler.java:739)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
android.os.Handler.dispatchMessage(Handler.java:95)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
android.os.Looper.loop(Looper.java:135)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
android.app.ActivityThread.main(ActivityThread.java:5254)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
java.lang.reflect.Method.invoke(Native Method)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
java.lang.reflect.Method.invoke(Method.java:372)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:903)
09-11 12:47:46.402 3932-3932/org.lds.ldssa.dev W/System.err: at
com.android.internal.os.ZygoteInit.main(ZygoteInit.java:698)

chro...@googlecode.com

unread,
Sep 11, 2015, 4:06:29 PM9/11/15
to chromi...@chromium.org

Comment #11 on issue 530623 by jdd...@chromium.org: WebView crashing in
content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623

FWIW, this change fixed it in M46
https://codereview.chromium.org/1242613002/. I'll upload a proposed fix for
M45.

chro...@googlecode.com

unread,
Sep 11, 2015, 4:22:30 PM9/11/15
to chromi...@chromium.org

Comment #12 on issue 530623 by jdd...@chromium.org: WebView crashing in
content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623

Proposed fix is here:
https://chrome-internal-review.googlesource.com/#/c/230465/. amineer@ let
me know how you'd like to proceed.

chro...@googlecode.com

unread,
Sep 11, 2015, 4:25:32 PM9/11/15
to chromi...@chromium.org

Comment #13 on issue 530623 by jeffdc...@gmail.com: WebView crashing in
content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623

Thanks for working on this issue. I will try some of your suggestions to
see if we can work around this issue (till a fix is released).

Thanks for suspending the roll out. As an FYI, our Analytics reports shows
that our usage on Sunday goes up dramatically (260,000+ active users during
the weekdays and 700,000+ active users on Sundays (Our support team is
expecting a heavy load this weekend))

chro...@googlecode.com

unread,
Sep 11, 2015, 4:39:30 PM9/11/15
to chromi...@chromium.org

Comment #14 on issue 530623 by jdd...@chromium.org: WebView crashing in
content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623

As boliu@ pointed out offline, this issue may also affect M44, but only on
Android M.

chro...@googlecode.com

unread,
Sep 14, 2015, 6:14:22 PM9/14/15
to chromi...@chromium.org
Updates:
Labels: Merge-Approved-45

Comment #16 on issue 530623 by amin...@google.com: WebView crashing in
content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623

Sorry for the radio silence, I was out of town for a couple days and I
wanted to give the build some more time in the field to see what crash
statistics did before making a decision one way or the other (though I
should have said so here). This is now 20% of all crashes, so we should
get a fix in before ramping up the rate. Merge is approved for M45 branch
2454, I'll figure out deployment tomorrow.

chro...@googlecode.com

unread,
Sep 14, 2015, 6:47:35 PM9/14/15
to chromi...@chromium.org
Updates:
Labels: -Merge-Approved-45 merge-merged-2454

Comment #17 on issue 530623 by bugd...@chromium.org: WebView crashing in
content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623#c17

The following revision refers to this bug:

https://chrome-internal.googlesource.com/clank/internal/apps/+/84ea118a824b483c6b43a5ebe82dd98ad49c3ae0

commit 84ea118a824b483c6b43a5ebe82dd98ad49c3ae0
Author: Jared Duke <jdd...@google.com>
Date: Fri Sep 11 20:11:49 2015

chro...@googlecode.com

unread,
Sep 14, 2015, 8:30:37 PM9/14/15
to chromi...@chromium.org
Updates:
Status: Started

Comment #18 on issue 530623 by jdd...@chromium.org: WebView crashing in
content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623

Issue should be fixed in M45, I'll keep this open until we get deployment
sorted out.

chro...@googlecode.com

unread,
Sep 15, 2015, 7:20:14 PM9/15/15
to chromi...@chromium.org

Comment #19 on issue 530623 by satyavat...@chromium.org: WebView crashing
in content::ContentViewCoreImpl::OnSelectionEvent
https://code.google.com/p/chromium/issues/detail?id=530623

We(testing team) verified this fix on latest M45/45.0.2454.95 on several L
devices.
on non-L devices- we didn't see issue on 45.0.2454.87 (or) 45.0.2454.95.
Reply all
Reply to author
Forward
0 new messages