Bug 180940 – Blank page except for inner iframes because pending stylesheets cause style.isNotFinal() to be true

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Justin Ridgewell]

Created attachment 329664 [details]
NYPost HTML

The AMP team is seeing a few pages that render completely blank, except for nested iframes in the page. The easiest to demo on is https://nypost-com.cdn.ampproject.org/c/s/nypost.com/2017/12/18/hunter-fatally-shoots-hiker-he-mistook-for-wild-boar/amp/

I'm able to reproduce on iOS 11.0.3 (iPhone SE), iOS 11.2.1 (iPhone X), Safari 11.0 (Sierra), and Tech Preview 45 (Sierra). The easiest to reproduce (~90% of the time) is:

Steps to reproduce
1. In Safari, open a private page (the point here is to have no cache)
2. Go to https://nypost-com.cdn.ampproject.org/c/s/nypost.com/2017/12/18/hunter-fatally-shoots-hiker-he-mistook-for-wild-boar/amp/

Refreshing the page will always render. Closing the private mode then re-opening private mode renders blank (again 90% and cache seems to be the problem).

Strangely, after these blank renders, it's impossible to get anything to show. Try setting the innerHTML of the HTML element, or in fact replacing the HTML element with a brand new one. Nothing renders.

Also strangely, I'm unable to reproduce this serving from a local server, even if the page is byte-for-byte match. I don't know if this is because of some special behavior with localhost domain. However, nypost.com will trigger the bug (https://nypost.com/2017/12/18/hunter-fatally-shoots-hiker-he-mistook-for-wild-boar/amp/ ) the same as nypost-com.cdn.ampproject.org.

For reference, I'm attaching the exact HTML returned, and the headers.

[Justin Ridgewell]

Created attachment 329665 [details]
NYPost headers

[Justin Ridgewell]

Created attachment 329666 [details]
NYPost HTML gzip

Attaching the gzip that's actually transmitted. I'm at a complete loss for what's causing the cdn v localhost server difference.

[Malte Ubl]

I also tried via Github Pages without repro. One difference may be HTTP2 shared with resources.
https://cramforce.github.io/playground/webkit-bug/1.html

[Malte Ubl]

I can also reproduce this with Safari 10.3 in iOS Simulator. So doesn't seem to be an iOS11 regression.

[Simon Fraser (smfr)]

I was able to reproduce after a few tries on iPad.

[Radar WebKit Bug Importer]

<rdar://problem/36116507>

[Simon Fraser (smfr)]

Oddly all the compositing layers are there, but just blank. Toggling style properties in the inspector doesn't trigger paints. Rotation and zooming don't trigger paints.

[Malte Ubl]

One idea is that this is a different manifestation of https://bugs.webkit.org/show_bug.cgi?id=171883

[Simon Fraser (smfr)]

This happens because we get into a state where style().isNotFinal() is true so RenderLayers don't paint. style().isNotFinal() depends on whether stylesheets are pending (see TreeResolver::resolveElement()).

[Simon Fraser (smfr)]

I confirmed that TreeResolver::m_didSeePendingStylesheet is true in the main document long after the load completes. Web inspector doesn't show any failed CSS loads.

[Justin Ridgewell]

I've been able to reduce the test case pretty drastically. Please see https://github.com/jridgewell/webkit-h2-style-blank-page for a full reproduction (still, ~90% failure rate).

[Justin Ridgewell]

Woo, after a few hours, we've narrowed it down to the cause. See https://github.com/jridgewell/webkit-h2-style-blank-page for a full reproduction.

1. There must be a stylesheet that has an @import
2. The inner imported stylesheet must take a X milliseconds
3. Clone the <link> for the original stylesheet, replace the original with the clone.
  - This must happen before X milliseconds is up

AMP has some clever hack for font-loading using such a technique. But, it bit us in the end. AMP will be disabling it, but this still leaves a bug in Safari.

[Malte Ubl]

We are deploying a workaround on the AMP side (deactivating a performance optimization for WebKit users).

[Antti Koivisto]

Created attachment 330817 [details]
patch

[WebKit Commit Bot]

Comment on attachment 330817 [details]
patch

Clearing flags on attachment: 330817

Committed r226653: <https://trac.webkit.org/changeset/226653>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.