Deadlocks in UIKeyboardTaskQueue from WKContentView(WKInteraction) endSelectionChange.

• Component: Accessibility
• Status: NEW ---

[Justin Cohen]

Chrome is seeing a growing number of watchdog kills a day with stacks similar to below on iOS 15.0 and 15.1, as iOS 15 continues to be adopted.

Perhaps the fix for https://bugs.webkit.org/show_bug.cgi?id=228051 https://trac.webkit.org/changeset/280019/webkit introduced a deadlock?

0x00000001baaa5550	(libsystem_kernel.dylib + 0x00001550)		__psynch_cvwait
0x00000001daed3994	(libsystem_pthread.dylib + 0x00001994)		_pthread_cond_wait$VARIANT$armv81
0x0000000182c85d2c	(Foundation + 0x00084d2c)		-[NSCondition waitUntilDate:]
0x0000000182c780ec	(Foundation + 0x000770ec)		-[NSConditionLock lockWhenCondition:beforeDate:]
0x0000000183d9997c	(UIKitCore + 0x0057897c)		-[UIKeyboardTaskQueue lockWhenReadyForMainThread]
0x0000000183b73d70	(UIKitCore + 0x00352d70)		-[UIKeyboardTaskQueue waitUntilAllTasksAreFinished]
0x00000001844d02f0	(UIKitCore + 0x00caf2f0)		-[UIKeyboardImpl generateAutofillCandidateByAddingTask:]
0x0000000183e04214	(UIKitCore + 0x005e3214)		-[UIKeyboardImpl selectionDidChange:]
0x000000018f64ecc0	(WebKit + 0x00770cc0)		-[WKContentView(WKInteraction) endSelectionChange]
0x0000000184868f74	(UIKitCore + 0x0000000001047f74)		-[UITextSelectionInteraction tappedToPositionCursorWithGesture:atPoint:granularity:completionHandler:]
0x0000000184868cac	(UIKitCore + 0x0000000001047cac)		-[UITextSelectionInteraction _checkForRepeatedTap:gestureLocationOut:]
0x0000000184869724	(UIKitCore + 0x0000000001048724)		-[UITextSelectionInteraction _handleMultiTapGesture:]
0x0000000183cc04cc	(UIKitCore + 0x0049f4cc)		-[UIApplication sendAction:to:from:forEvent:]
0x00000001842a0674	(UIKitCore + 0x00a7f674)		-[UITextMultiTapRecognizer onStateUpdate:]
0x00000001839ef784	(UIKitCore + 0x001ce784)		-[UIGestureRecognizerTarget _sendActionWithGestureRecognizer:]
0x00000001839b8f64	(UIKitCore + 0x00197f64)		_UIGestureRecognizerSendTargetActions
0x0000000183983a7c	(UIKitCore + 0x00162a7c)		_UIGestureRecognizerSendActions
0x00000001839bb23c	(UIKitCore + 0x0019a23c)		-[UIGestureRecognizer _updateGestureForActiveEvents]
0x0000000183975364	(UIKitCore + 0x00154364)		_UIGestureEnvironmentUpdate
0x00000001839a7f20	(UIKitCore + 0x00186f20)		-[UIGestureEnvironment _updateForEvent:window:]
0x00000001839b477c	(UIKitCore + 0x0019377c)		-[UIWindow sendEvent:]

[Radar WebKit Bug Importer]

<rdar://problem/83950285>

[Wenson Hsieh]

The changes in r280019 would only kick in if the user has Switch Control active (in Accessibility settings). Is that the case here?

[Justin Cohen]

Neither Apple provided crash reports nor Chrome generated hang reports indicate that state, so it's impossible to say. This particular stack is new for us in iOS15.

[Ali Juma]

We are still getting reports of this hang on iOS 15.4 beta (19E5225g).

(In reply to Wenson Hsieh from comment #2)
> The changes in r280019 would only kick in if the user has Switch Control
> active (in Accessibility settings). Is that the case here?

Someone who ran into this hang let us know they don't have Switch Control enabled, but do have an external keyboard.

[Wenson Hsieh]

(In reply to Ali Juma from comment #4)
> We are still getting reports of this hang on iOS 15.4 beta (19E5225g).
> 
> (In reply to Wenson Hsieh from comment #2)
> > The changes in r280019 would only kick in if the user has Switch Control
> > active (in Accessibility settings). Is that the case here?
> 
> Someone who ran into this hang let us know they don't have Switch Control
> enabled, but do have an external keyboard.

Thanks! That's really good to know. To summarize, I think the three clues we have so far are that this bug:

• Reproduces while performing a single tap to change the editable selection
• Does not require Switch Control to reproduce
• Reproduces with a hardware keyboard attached
  (though, it's unclear if it *only* reproduces when a hardware keyboard is attached)

I haven't been able to reproduce simply by tapping around inside contenteditable text with a hardware keyboard attached on iPad, so there's definitely more to this bug. In the meantime, do you have stats on which device models (i.e. iPad vs. iPhone) are experiencing this hang? If a disproportionate number of users are hitting this on iPad (despite iPhone users being far more common), I think it would be a strong indication that the hardware keyboard plays an important role in reproducing this.

[Ali Juma]

(In reply to Wenson Hsieh from comment #5)
> (In reply to Ali Juma from comment #4)
> > We are still getting reports of this hang on iOS 15.4 beta (19E5225g).
> > 
> > (In reply to Wenson Hsieh from comment #2)
> > > The changes in r280019 would only kick in if the user has Switch Control
> > > active (in Accessibility settings). Is that the case here?
> > 
> > Someone who ran into this hang let us know they don't have Switch Control
> > enabled, but do have an external keyboard.
> 
> Thanks! That's really good to know. To summarize, I think the three clues we
> have so far are that this bug:
> 
> • Reproduces while performing a single tap to change the editable selection
> • Does not require Switch Control to reproduce
> • Reproduces with a hardware keyboard attached
>   (though, it's unclear if it *only* reproduces when a hardware keyboard is
> attached)
> 
> I haven't been able to reproduce simply by tapping around inside
> contenteditable text with a hardware keyboard attached on iPad, so there's
> definitely more to this bug. In the meantime, do you have stats on which
> device models (i.e. iPad vs. iPhone) are experiencing this hang? If a
> disproportionate number of users are hitting this on iPad (despite iPhone
> users being far more common), I think it would be a strong indication that
> the hardware keyboard plays an important role in reproducing this.

The crash is affecting both iPad and iPhone. The most commonly affected devices are older iPhones (6s, 7, 7 plus). 

The iPhone vs iPad breakdown looks similar to the percentage of users on each device.

[Wenson Hsieh]

(In reply to Ali Juma from comment #6)
> (In reply to Wenson Hsieh from comment #5)
> > (In reply to Ali Juma from comment #4)
> > > We are still getting reports of this hang on iOS 15.4 beta (19E5225g).
> > > 
> > > (In reply to Wenson Hsieh from comment #2)
> > > > The changes in r280019 would only kick in if the user has Switch Control
> > > > active (in Accessibility settings). Is that the case here?
> > > 
> > > Someone who ran into this hang let us know they don't have Switch Control
> > > enabled, but do have an external keyboard.
> > 
> > Thanks! That's really good to know. To summarize, I think the three clues we
> > have so far are that this bug:
> > 
> > • Reproduces while performing a single tap to change the editable selection
> > • Does not require Switch Control to reproduce
> > • Reproduces with a hardware keyboard attached
> >   (though, it's unclear if it *only* reproduces when a hardware keyboard is
> > attached)
> > 
> > I haven't been able to reproduce simply by tapping around inside
> > contenteditable text with a hardware keyboard attached on iPad, so there's
> > definitely more to this bug. In the meantime, do you have stats on which
> > device models (i.e. iPad vs. iPhone) are experiencing this hang? If a
> > disproportionate number of users are hitting this on iPad (despite iPhone
> > users being far more common), I think it would be a strong indication that
> > the hardware keyboard plays an important role in reproducing this.
> 
> The crash is affecting both iPad and iPhone. The most commonly affected
> devices are older iPhones (6s, 7, 7 plus). 
> 
> The iPhone vs iPad breakdown looks similar to the percentage of users on
> each device.

I see, thanks for the info! Definitely not specific to the hardware keyboard, then...