Sitelet https://github.com/flutter/flutter/issues/51066
Skip to content

skia crash in SkCanvas::drawTextBlob() #51066

Description

@allenbrunson

Steps to Reproduce

  1. Run flutter create bug.
  2. Update the files as follows: ...
  3. ...

Expected results:

Actual results:

Logs

there is no abnormal log output. the app just dies with a null pointer exception, which occurs in skia C++ code, not in dart code. the crash happens on ios and android devices, and on both the ios and android simulators. (i am using a mac.)

Analyzing fireball...
No issues found! (ran in 1.9s)
flutter doctor -v
[✓] Flutter (Channel stable, v1.12.13+hotfix.8, on Mac OS X 10.14.6 18G3020, locale en-US)
    • Flutter version 1.12.13+hotfix.8 at /Users/allen/dart/flutter
    • Framework revision 0b8abb4724 (8 days ago), 2020-02-11 11:44:36 -0800
    • Engine revision e1e6ced81d
    • Dart version 2.7.0

[✓] Android toolchain - develop for Android devices (Android SDK version 28.0.3)
    • Android SDK at /Users/allen/Library/Android/sdk
    • Android NDK location not configured (optional; useful for native profiling support)
    • Platform android-28, build-tools 28.0.3
    • Java binary at: /Applications/Android Studio.app/Contents/jre/jdk/Contents/Home/bin/java
    • Java version OpenJDK Runtime Environment (build 1.8.0_202-release-1483-b49-5587405)
    • All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 11.3.1)
    • Xcode at /Applications/Xcode.app/Contents/Developer
    • Xcode 11.3.1, Build version 11C504
    • CocoaPods version 1.8.4

[✓] Android Studio (version 3.5)
    • Android Studio at /Applications/Android Studio.app/Contents
    • Flutter plugin version 43.0.1
    • Dart plugin version 191.8593
    • Java version OpenJDK Runtime Environment (build 1.8.0_202-release-1483-b49-5587405)

[✓] Connected device (1 available)
    • iPhone 11 • 256CEC9B-F830-4039-94EB-77A783C0DF02 • ios • com.apple.CoreSimulator.SimRuntime.iOS-13-3 (simulator)

• No issues found!

I have encountered a serious crashing bug in my flutter app. I have been working on it for about a year now. My company was in the testing phase for this app, but it crashes many times per hour for all our users, so testing has come to a halt.

Unfortunately, despite over 50 hours of trying, I cannot create a reproducible test case. It is extremely timing-dependent, and happens only about one try out of 100. there are many thousands of lines of Dart code involved. (there are some widgets where I can make it happen more often.)

The crash does not happen in my own Dart code, or in any Dart code at all, in fact. The crash happens in C++ code inside Skia. This makes the bug nearly impossible for me to isolate, because my code is only indirectly affecting the Skia code which crashes.

The steps that cause the crash are:

  1. widget A is displayed for the user. She presses a button, which causes widget B to be pushed onto the stack. the normal right-to-left animation occurs, as widget A is animated offscreen, and widget B appears.

  2. the user makes a choice in widget B. Now we're done with it, so it is popped off the stack. The usual left-to-right animation happens, as widget B is moved offscreen and widget A reappears.

  3. the animation finishes, and widget A is now displayed onscreen. presumably, widget B is deallocated.

  4. skia crashes, producing the stack trace shown below.

the crash happens only intermittently. my best guess is that widget B does a setState() call shortly before its death, then it gets deallocated, but the skia engine tries to redraw it anyway, leading to the crash. but that is just a guess.

crashed thread name: io.flutter.1.ui

#0	(null) in SkCanvas::drawTextBlob(SkTextBlob const*, float, float, SkPaint const&) ()
#1	(null) in txt::ParagraphTxt::Paint(SkCanvas*, double, double) ()
#2	(null) in tonic::DartDispatcher<tonic::IndicesHolder<0ul, 1ul, 2ul>, void (flutter::Paragraph::*)(flutter::Canvas*, double, double)>::Dispatch(void (flutter::Paragraph::*)(flutter::Canvas*, double, double)) ()
#3	(null) in void tonic::DartCall<void (flutter::Paragraph::*)(flutter::Canvas*, double, double)>(void (flutter::Paragraph::*)(flutter::Canvas*, double, double), _Dart_NativeArguments*) ()
#4	(null) in dart::NativeEntry::AutoScopeNativeCallWrapperNoStackCheck(_Dart_NativeArguments*, void (*)(_Dart_NativeArguments*)) ()
#5	(null) in 0 ()
#6	(null) in 0 ()
#7	(null) in 0 ()
#8	(null) in 0 ()
#9	(null) in 0 ()
#10	(null) in 0 ()
#11	(null) in 0 ()
#12	(null) in 0 ()
#13	(null) in 0 ()
#14	(null) in 0 ()
#15	(null) in 0 ()
#16	(null) in 0 ()
#17	(null) in 0 ()
#18	(null) in 0 ()
#19	(null) in 0 ()
#20	(null) in 0 ()
#21	(null) in 0 ()
#22	(null) in 0 ()
#23	(null) in 0 ()
#24	(null) in 0 ()
#25	(null) in 0 ()
#26	(null) in 0 ()
#27	(null) in 0 ()
#28	(null) in 0 ()
#29	(null) in 0 ()
#30	(null) in 0 ()
#31	(null) in 0 ()
#32	(null) in 0 ()
#33	(null) in 0 ()
#34	(null) in 0 ()
#35	(null) in 0 ()
#36	(null) in 0 ()
#37	(null) in 0 ()
#38	(null) in 0 ()
#39	(null) in 0 ()
#40	(null) in 0 ()
#41	(null) in 0 ()
#42	(null) in 0 ()
#43	(null) in 0 ()
#44	(null) in 0 ()
#45	(null) in 0 ()
#46	(null) in 0 ()
#47	(null) in 0 ()
#48	(null) in 0 ()
#49	(null) in 0 ()
#50	(null) in 0 ()
#51	(null) in 0 ()
#52	(null) in 0 ()
#53	(null) in 0 ()
#54	(null) in 0 ()
#55	(null) in 0 ()
#56	(null) in 0 ()
#57	(null) in 0 ()
#58	(null) in 0 ()
#59	(null) in 0 ()
#60	(null) in 0 ()
#61	(null) in 0 ()
#62	(null) in 0 ()
#63	(null) in 0 ()
#64	(null) in 0 ()
#65	(null) in 0 ()
#66	(null) in 0 ()
#67	(null) in 0 ()
#68	(null) in 0 ()
#69	(null) in 0 ()
#70	(null) in 0 ()
#71	(null) in 0 ()
#72	(null) in 0 ()
#73	(null) in 0 ()
#74	(null) in 0 ()
#75	(null) in 0 ()
#76	(null) in 0 ()
#77	(null) in 0 ()
#78	(null) in 0 ()
#79	(null) in 0 ()
#80	(null) in 0 ()
#81	(null) in 0 ()
#82	(null) in 0 ()
#83	(null) in 0 ()
#84	(null) in 0 ()
#85	(null) in 0 ()
#86	(null) in 0 ()
#87	(null) in 0 ()
#88	(null) in 0 ()
#89	(null) in 0 ()
#90	(null) in 0 ()
#91	(null) in 0 ()
#92	(null) in 0 ()
#93	(null) in 0 ()
#94	(null) in 0 ()
#95	(null) in 0 ()
#96	(null) in 0 ()
#97	(null) in 0 ()
#98	(null) in 0 ()
#99	(null) in 0 ()
#100	(null) in 0 ()
#101	(null) in 0 ()
#102	(null) in 0 ()
#103	(null) in 0 ()
#104	(null) in 0 ()
#105	(null) in 0 ()
#106	(null) in 0 ()
#107	(null) in 0 ()
#108	(null) in 0 ()
#109	(null) in 0 ()
#110	(null) in 0 ()
#111	(null) in 0 ()
#112	(null) in 0 ()
#113	(null) in 0 ()
#114	(null) in 0 ()
#115	(null) in 0 ()
#116	(null) in 0 ()
#117	(null) in 0 ()
#118	(null) in 0 ()
#119	(null) in 0 ()
#120	(null) in 0 ()
#121	(null) in 0 ()
#122	(null) in 0 ()
#123	(null) in 0 ()
#124	(null) in 0 ()
#125	(null) in 0 ()
#126	(null) in 0 ()
#127	(null) in 0 ()
#128	(null) in 0 ()
#129	(null) in 0 ()
#130	(null) in 0 ()
#131	(null) in 0 ()
#132	(null) in 0 ()
#133	(null) in 0 ()
#134	(null) in 0 ()
#135	(null) in 0 ()
#136	(null) in 0 ()
#137	(null) in 0 ()
#138	(null) in 0 ()
#139	(null) in 0 ()
#140	(null) in 0 ()
#141	(null) in 0 ()
#142	(null) in 0 ()
#143	(null) in 0 ()
#144	(null) in 0 ()
#145	(null) in 0 ()
#146	(null) in 0 ()
#147	(null) in 0 ()
#148	(null) in 0 ()
#149	(null) in 0 ()
#150	(null) in 0 ()
#151	(null) in 0 ()
#152	(null) in 0 ()
#153	(null) in 0 ()
#154	(null) in 0 ()
#155	(null) in 0 ()
#156	(null) in 0 ()
#157	(null) in 0 ()
#158	(null) in 0 ()
#159	(null) in 0 ()
#160	(null) in 0 ()
#161	(null) in 0 ()
#162	(null) in 0 ()
#163	(null) in 0 ()
#164	(null) in 0 ()
#165	(null) in 0 ()
#166	(null) in 0 ()
#167	(null) in 0 ()
#168	(null) in 0 ()
#169	(null) in 0 ()
#170	(null) in 0 ()
#171	(null) in 0 ()
#172	(null) in 0 ()
#173	(null) in 0 ()
#174	(null) in 0 ()
#175	(null) in 0 ()
#176	(null) in 0 ()
#177	(null) in 0 ()
#178	(null) in 0 ()
#179	(null) in 0 ()
#180	(null) in 0 ()
#181	(null) in 0 ()
#182	(null) in 0 ()
#183	(null) in 0 ()
#184	(null) in 0 ()
#185	(null) in 0 ()
#186	(null) in 0 ()
#187	(null) in 0 ()
#188	(null) in 0 ()
#189	(null) in 0 ()
#190	(null) in 0 ()
#191	(null) in 0 ()
#192	(null) in 0 ()
#193	(null) in 0 ()
#194	(null) in 0 ()
#195	(null) in 0 ()
#196	(null) in 0 ()
#197	(null) in 0 ()
#198	(null) in dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned long) ()
#199	(null) in dart::Library::Invoke(dart::String const&, dart::Array const&, dart::Array const&, bool, bool) const ()
#200	(null) in Dart_Invoke ()
#201	(null) in flutter::Window::BeginFrame(fml::TimePoint) ()
#202	(null) in flutter::RuntimeController::BeginFrame(fml::TimePoint) ()
#203	(null) in flutter::Engine::BeginFrame(fml::TimePoint) ()
#204	(null) in flutter::Animator::BeginFrame(fml::TimePoint, fml::TimePoint) ()
#205	(null) in std::__1::function<void (fml::TimePoint, fml::TimePoint)>::operator()(fml::TimePoint, fml::TimePoint) const ()
#206	(null) in std::__1::__function::__func<flutter::VsyncWaiter::FireCallback(fml::TimePoint, fml::TimePoint)::$_0, std::__1::allocator<flutter::VsyncWaiter::FireCallback(fml::TimePoint, fml::TimePoint)::$_0>, void ()>::operator()() ()
#207	(null) in fml::MessageLoopImpl::FlushTasks(fml::FlushType) ()
#208	(null) in fml::MessageLoopDarwin::OnTimerFire(__CFRunLoopTimer*, fml::MessageLoopDarwin*) ()
#209	(null) in __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ ()
#210	(null) in __CFRunLoopDoTimer ()
#211	(null) in __CFRunLoopDoTimers ()
#212	(null) in __CFRunLoopRun ()
#213	(null) in CFRunLoopRunSpecific ()
#214	(null) in fml::MessageLoopDarwin::Run() ()
#215	(null) in fml::MessageLoopImpl::DoRun() ()
#216	(null) in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, fml::Thread::Thread(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&)::$_0> >(void*) ()
#217	(null) in _pthread_body ()
#218	(null) in _pthread_start ()
#219	(null) in thread_start ()

No activity

Activity on this issue will appear here.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    c: crashStack traces logged to the consoleengineflutter/engine related. See also e: labels.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions