uazo / cromite

Cromite a Bromite fork with ad blocking and privacy enhancements; take back your browser!
https://www.cromite.org/
GNU General Public License v3.0
3.24k stars 73 forks source link

System WebView crashes #1425

Open danielk43 opened 1 week ago

danielk43 commented 1 week ago

Preliminary checklist

Can the bug be reproduced with corresponding Chromium version?

Yes

Are you sure?

Yes

Cromite version

128.0.6613.114

Device architecture

arm64

Platform version

Android 13

Android Device model

Pixel 5a (barbet)

Is the device rooted?

No

Changed flags

no flags changed

Is this bug happening in an incognito tab?

No

Is this bug caused by the adblocker?

No

Is this bug a crash?

09-01 17:47:09.273  6378  6378 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
09-01 17:47:09.273  6378  6378 F DEBUG   : LineageOS Version: '20.0-20240901-unofficial-barbet'
09-01 17:47:09.273  6378  6378 F DEBUG   : Build fingerprint: 'google/barbet/barbet:13/TQ3A.230901.001/10750268:user/release-keys'
09-01 17:47:09.273  6378  6378 F DEBUG   : Revision: 'MP1.0'
09-01 17:47:09.273  6378  6378 F DEBUG   : ABI: 'arm64'
09-01 17:47:09.273  6378  6378 F DEBUG   : Timestamp: 2024-09-01 17:47:08.519021702-0400
09-01 17:47:09.273  6378  6378 F DEBUG   : Process uptime: 53s
09-01 17:47:09.273  6378  6378 F DEBUG   : Cmdline: zzz
09-01 17:47:09.273  6378  6378 F DEBUG   : pid: 5797, tid: 6272, name: RenderThread  >>> zzz <<<
09-01 17:47:09.273  6378  6378 F DEBUG   : uid: 10169
09-01 17:47:09.273  6378  6378 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x00000000000005fa
09-01 17:47:09.273  6378  6378 F DEBUG   : Cause: null pointer dereference
09-01 17:47:09.273  6378  6378 F DEBUG   :     x0  0000000000000001  x1  0000000000000000  x2  000000603beddfae  x3  0000000000000001
09-01 17:47:09.273  6378  6378 F DEBUG   :     x4  0000000000000001  x5  0000000000000000  x6  fefefefeff11feff  x7  7f7f7f7f7f7f7f7f
09-01 17:47:09.273  6378  6378 F DEBUG   :     x8  000000260154b480  x9  0000000000000000  x10 0000000000000000  x11 0000000000000020
09-01 17:47:09.273  6378  6378 F DEBUG   :     x12 000000606d7fb040  x13 00000026038e3765  x14 0000002400008086  x15 0000000000000000
09-01 17:47:09.273  6378  6378 F DEBUG   :     x16 0000006044f39740  x17 000000611486ee40  x18 000000606cb2e000  x19 0000002603938e40
09-01 17:47:09.273  6378  6378 F DEBUG   :     x20 000000260154b480  x21 0000002604804d00  x22 0000002603938e40  x23 000000260154b480
09-01 17:47:09.273  6378  6378 F DEBUG   :     x24 0000002604122278  x25 0000002604122278  x26 000000606d7fb040  x27 0000000000000001
09-01 17:47:09.273  6378  6378 F DEBUG   :     x28 0000002602dc0c80  x29 000000606d52e960
09-01 17:47:09.273  6378  6378 F DEBUG   :     lr  000000604287dd78  sp  000000606d52e960  pc  000000604287dd84  pst 0000000060001000
09-01 17:47:09.273  6378  6378 F DEBUG   : backtrace:
09-01 17:47:09.274  6378  6378 F DEBUG   :       #00 pc 0000000006dead84  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #01 pc 0000000006ddb9a8  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #02 pc 0000000006f27db4  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #03 pc 0000000006f278cc  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #04 pc 0000000006f23684  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #05 pc 0000000006f266d0  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #06 pc 000000000289d408  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #07 pc 000000000289d724  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #08 pc 000000000289d69c  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #09 pc 000000000289df58  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #10 pc 000000000289e980  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #11 pc 0000000002886750  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #12 pc 0000000002895368  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #13 pc 0000000002877efc  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #14 pc 0000000002877630  /product/app/SystemWebView/SystemWebView.apk!libwebviewchromium.so (offset 0xb04000) (BuildId: eaebfaee075af39887c67b638790887e8bd664a0)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #15 pc 0000000000002470  /system/lib64/libwebviewchromium_plat_support.so (android::(anonymous namespace)::draw_gl(int, void*, android::uirenderer::DrawGlInfo const&, android::uirenderer::WebViewOverlayData const&)+328) (BuildId: 9b3a5ce6c6aeb413e36aa601cdbe20cd)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #16 pc 000000000029de30  /system/lib64/libhwui.so (android::uirenderer::WebViewFunctor::drawGl(android::uirenderer::DrawGlInfo const&)+196) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #17 pc 00000000002725b0  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::GLFunctorDrawable::onDraw(SkCanvas*)+1620) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #18 pc 00000000002ff844  /system/lib64/libhwui.so (SkDrawable::draw(SkCanvas*, SkMatrix const*)+116) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #19 pc 0000000000630da0  /system/lib64/libhwui.so (skgpu::v1::Device::drawDrawable(SkCanvas*, SkDrawable*, SkMatrix const*)+344) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #20 pc 0000000000252f00  /system/lib64/libhwui.so (android::uirenderer::$_37::__invoke(void const*, SkCanvas*, SkMatrix const&)+136) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #21 pc 0000000000250018  /system/lib64/libhwui.so (android::uirenderer::DisplayListData::draw(SkCanvas*) const+124) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #22 pc 0000000000239b70  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::RenderNodeDrawable::drawContent(SkCanvas*) const+1748) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #23 pc 000000000023a29c  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::RenderNodeDrawable::forceDraw(SkCanvas*) const+284) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #24 pc 00000000002ff844  /system/lib64/libhwui.so (SkDrawable::draw(SkCanvas*, SkMatrix const*)+116) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #25 pc 0000000000250018  /system/lib64/libhwui.so (android::uirenderer::DisplayListData::draw(SkCanvas*) const+124) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #26 pc 0000000000239b70  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::RenderNodeDrawable::drawContent(SkCanvas*) const+1748) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #27 pc 000000000023a29c  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::RenderNodeDrawable::forceDraw(SkCanvas*) const+284) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #28 pc 00000000002ff844  /system/lib64/libhwui.so (SkDrawable::draw(SkCanvas*, SkMatrix const*)+116) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #29 pc 0000000000250018  /system/lib64/libhwui.so (android::uirenderer::DisplayListData::draw(SkCanvas*) const+124) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #30 pc 0000000000239b70  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::RenderNodeDrawable::drawContent(SkCanvas*) const+1748) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #31 pc 000000000023a29c  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::RenderNodeDrawable::forceDraw(SkCanvas*) const+284) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #32 pc 00000000002ff844  /system/lib64/libhwui.so (SkDrawable::draw(SkCanvas*, SkMatrix const*)+116) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #33 pc 0000000000250018  /system/lib64/libhwui.so (android::uirenderer::DisplayListData::draw(SkCanvas*) const+124) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #34 pc 0000000000239b70  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::RenderNodeDrawable::drawContent(SkCanvas*) const+1748) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #35 pc 000000000023a29c  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::RenderNodeDrawable::forceDraw(SkCanvas*) const+284) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #36 pc 00000000002ff844  /system/lib64/libhwui.so (SkDrawable::draw(SkCanvas*, SkMatrix const*)+116) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #37 pc 0000000000250018  /system/lib64/libhwui.so (android::uirenderer::DisplayListData::draw(SkCanvas*) const+124) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #38 pc 0000000000239b70  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::RenderNodeDrawable::drawContent(SkCanvas*) const+1748) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #39 pc 000000000023a29c  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::RenderNodeDrawable::forceDraw(SkCanvas*) const+284) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #40 pc 00000000002ff844  /system/lib64/libhwui.so (SkDrawable::draw(SkCanvas*, SkMatrix const*)+116) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #41 pc 0000000000278ee4  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::SkiaPipeline::renderFrameImpl(SkRect const&, std::__1::vector<android::sp<android::uirenderer::RenderNode>, std::__1::allocator<android::sp<android::uirenderer::RenderNode> > > const&, bool, android::uirenderer::Rect const&, SkCanvas*, SkMatrix const&)+484) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #42 pc 0000000000278a68  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::SkiaPipeline::renderFrame(android::uirenderer::LayerUpdateQueue const&, SkRect const&, std::__1::vector<android::sp<android::uirenderer::RenderNode>, std::__1::allocator<android::sp<android::uirenderer::RenderNode> > > const&, bool, android::uirenderer::Rect const&, sk_sp<SkSurface>, SkMatrix const&)+624) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #43 pc 0000000000276804  /system/lib64/libhwui.so (android::uirenderer::skiapipeline::SkiaOpenGLPipeline::draw(android::uirenderer::renderthread::Frame const&, SkRect const&, SkRect const&, android::uirenderer::LightGeometry const&, android::uirenderer::LayerUpdateQueue*, android::uirenderer::Rect const&, bool, android::uirenderer::LightInfo const&, std::__1::vector<android::sp<android::uirenderer::RenderNode>, std::__1::allocator<android::sp<android::uirenderer::RenderNode> > > const&, android::uirenderer::FrameInfoVisualizer*)+500) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #44 pc 000000000027dac0  /system/lib64/libhwui.so (android::uirenderer::renderthread::CanvasContext::draw()+792) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #45 pc 0000000000280748  /system/lib64/libhwui.so (std::__1::__function::__func<android::uirenderer::renderthread::DrawFrameTask::postAndWait()::$_0, std::__1::allocator<android::uirenderer::renderthread::DrawFrameTask::postAndWait()::$_0>, void ()>::operator()() (.11774b2169f1e74c003b539de5b3f651)+884) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #46 pc 00000000002707f0  /system/lib64/libhwui.so (android::uirenderer::WorkQueue::process()+580) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #47 pc 0000000000290718  /system/lib64/libhwui.so (android::uirenderer::renderthread::RenderThread::threadLoop()+412) (BuildId: bc0c57a47d05f477ab6bcc4e9f8ddc7b)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #48 pc 0000000000012f18  /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+416) (BuildId: d5f2c4a3dc8a5004ae147c40a674c885)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #49 pc 00000000000b38d8  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: 3147b71023117fa73764f70dfa641d17)
09-01 17:47:09.274  6378  6378 F DEBUG   :       #50 pc 000000000004f7ec  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 3147b71023117fa73764f70dfa641d17)

Describe the bug

I have been following your Webview updates, thanks for working on it. Something like this patch should fix the current build error for arm64.

After that it builds but once installed, it crashes. See debug log. I am not actually sure if it's related to AdBlocker but I have no control over it in WebView. Also I am building it into the OS and allowing it in config_webview_packages.xml. It shows as active/selected in Settings > System > Developer options > WebView implementation

Steps to reproduce the bug

1) Build, install, allow, and set Cromite as webview provider. 2) Open app which requires webview, observe crash. Confirm in adb logs

Expected behavior

Expected applications which rely on system webview to open and load content.

Screenshots

No response

uazo commented 1 week ago

try activating (or deactivating) vulkan, do you know how?

danielk43 commented 1 week ago

Thanks. Did you mean this gn arg?

enable_vulkan
    Current value (from the default) = true 
      From //gpu/vulkan/features.gni:11

    Enable experimental vulkan backend.
uazo commented 1 week ago

no need to recompile, try with:

adb shell am start -a "com.android.webview.SHOW_DEV_UI"
uazo commented 1 week ago

unfortunately I'm stuck, I can no longer activate the webview in the emulator... any suggestions?

danielk43 commented 1 week ago

Not for the emulator issue, sorry. Will try your suggestions on my side shortly, first without recompiling

danielk43 commented 1 week ago

I was able to launch the WebView DevTools UI:

$ adb shell am start -a com.android.webview.SHOW_DEV_UI
Starting: Intent { act=com.android.webview.SHOW_DEV_UI }

and changed WebViewVulkanIntermediateBuffer from Default to Enabled then to Disabled with no luck. Did not see any other Vulkan options under WebView Flags.

Will keep looking into it.

This might help if it is not launching

uazo commented 1 week ago

the problem is on my side. in the next release the webview will start working again. thanks for the report.

uazo commented 1 week ago

if you are interested, this is what you need to add to your build if you want to make it work:

--- a/components/variations/service/variations_field_trial_creator_base.cc
+++ b/components/variations/service/variations_field_trial_creator_base.cc
@@ -331,6 +331,8 @@ bool VariationsFieldTrialCreatorBase::SetUpFieldTrials(
                              safe_seed_manager, synthetic_trial_registry);
   }

+  platform_field_trials->RegisterFeatureOverrides(feature_list.get());
+
   base::FeatureList::SetInstance(std::move(feature_list));

   // For testing Variations Safe Mode, maybe crash here.
danielk43 commented 1 week ago

Nice! I see where that was removed in the Disable-fetching-of-all-field-trials patch. Will add it back and confirm.

danielk43 commented 1 week ago

WebView is now loading for me, and also when packaged as Trichrome. Thank you for the fix.

uazo commented 1 week ago

I would like to experiment with an idea for fast replacement of the webview implementation in the source code, for use by all opensource projects that use the webview (e.g. duckduckgo browser but also stoutner's privacy browser), but I don't have time.

do you have the will/skills? In case I can expose my idea.

danielk43 commented 1 week ago

I'd feel comfortable if there was a working example somewhere which could be adapted. If creating from scratch it would be challenging, but maybe. I'd be willing to try, at least. It sounds like an OS-level change though, no? Similar to some projects connectivity check settings but also enforcing build signature, etc.

uazo commented 1 week ago

no, code-side not system-side. the last one does not seem possible in non-rooted android.

everything I write is to be verified:

see getWebViewContextAndSetProvider() would appear to be the method used by the webview component to retrieve the implementer. the assumption is that that code runs under the current application, so Application initialApplication = AppGlobals.getInitialApplication(); is the application context.

the idea is to do an override of getPackageManager() and getSystemService() (perhaps via ContextWrapper) and in retrieving pm.getPackageInfo() send the information in PackageInfo with the data of the new webview.

the hope is that Flags.updateServiceIpcWrapper() is enabled by default and it is possible to do the override of the application context and that the android framework does not do any other checks on the validity of the signature or the location of the webview apk (but that Context.CONTEXT_IGNORE_SECURITY in code gives me some hope).

I realise that there are many ‘maybes’... If I had the time I would try it with the system_webview_shell.

danielk43 commented 1 week ago

Thanks for the details. The methods are new for me but conceptually it makes sense. Will begin looking this week and try to get into it a bit. Collab from anyone is welcome also.