Repository: flutter
Issue: [webview_flutter] crash when height is large/ wrapped within CustomScrollView in Android
Labels: platform-android,f: scrolling,p: webview,package,has reproducible steps,P2,c: fatal crash,found in release: 3.0,found in release: 3.1,team-android,triaged-android

<!-- Thank you for using Flutter!

     If you are looking for support, please check out our documentation
     or consider asking a question on Stack Overflow:
      * https://flutter.dev/
      * https://api.flutter.dev/
      * https://stackoverflow.com/questions/tagged/flutter?sort=frequent

     If you have found a bug or if our documentation doesn't have an answer
     to what you're looking for, then fill out the template below. Please read
     our guide to filing a bug first: https://flutter.dev/docs/resources/bug-reports
-->

same to https://github.com/flutter/flutter/issues/45243, but problem still here
iOS platform is normally, only crash in Android platform

video:

https://user-images.githubusercontent.com/19588517/177002579-b26ee0ba-17fc-49db-ac6a-46267e8b6edc.mp4

```
❯ fvm flutter doctor
Doctor summary (to see all details, run flutter doctor -v):
[✓] Flutter (Channel stable, 3.0.4, on macOS 12.4 21F79 darwin-arm, locale zh-Hant-HK)
[✓] Android toolchain - develop for Android devices (Android SDK version 31.0.0)
[✓] Xcode - develop for iOS and macOS (Xcode 13.4.1)
[✓] Chrome - develop for the web
[✓] Android Studio (version 2021.2)
[✓] VS Code (version 1.68.1)
[✓] Connected device (4 available)
[✓] HTTP Host Availability

```

## Steps to Reproduce

<!-- Please include full steps to reproduce so that we can reproduce the problem. -->

1. Execute `flutter run` on the code sample in Android platform <!-- (see "Code sample" section below) -->

**Expected results:** <!-- what did you want to see? -->
1. no  crash
2. scroll normally

**Actual results:** <!-- what did you see? -->
1. crash when height is large (in my case seem height > 10000)

<details>
<summary>Code sample</summary>

<!--
      Please create a minimal reproducible sample that shows the problem
      and attach it below between the lines with the backticks.

      To create it you can use `flutter create bug` command and update the `main.dart` file.

      Alternatively, you can use https://dartpad.dev/
      which is capable of creating and running small Flutter apps.

      Without this we will unlikely be able to progress on the issue, and because of that
      we regretfully will have to close it.
-->

```dart
class Example1Page extends StatefulWidget {
  const Example1Page({Key? key}) : super(key: key);

  @override
  State<Example1Page> createState() => _Example1PageState();
}

class _Example1PageState extends State<Example1Page> {
  double? height;
  Timer? _debounce;

  @override
  void initState() {
    super.initState();
    if (Platform.isAndroid) WebView.platform = SurfaceAndroidWebView();
  }

  void updateHeight(double height) async {
    if (_debounce?.isActive ?? false) _debounce?.cancel();
    // avoid too many rebuild when height is changing
    _debounce = Timer(const Duration(milliseconds: 500), () {
      if (this.height != height) {
        setState(() {
          this.height = height;
        });
      }
    });
  }

  @override
  void dispose() {
    _debounce?.cancel();
    super.dispose();
  }

  @override
  Widget build(BuildContext context) {
    return Scaffold(
      appBar: AppBar(),
      body: CustomScrollView(
        slivers: [
          SliverToBoxAdapter(
            child: Container(
              height: 200,
              color: Colors.red,
            ),
          ),
          SliverToBoxAdapter(
            child: Container(
              height: height ?? 100,
              color: Colors.blue,
              child: WebView(
                debuggingEnabled: true,
                initialUrl: 'https://flutter.dev/',
                javascriptMode: JavascriptMode.unrestricted,
                onWebViewCreated: (WebViewController webViewController) {
                  webViewController.runJavascript("""
                      const resizeObserver = new ResizeObserver(entries =>
  Resize.postMessage(document.documentElement.scrollHeight))
  resizeObserver.observe(document.body)
                    """);
                },
                javascriptChannels: {
                  JavascriptChannel(
                      name: "Resize",
                      onMessageReceived: (JavascriptMessage message) {
                        updateHeight(double.parse(message.message));
                      })
                },
              ),
            ),
          ),
          SliverToBoxAdapter(
            child: Container(
              height: 200,
              color: Colors.yellow,
            ),
          ),
        ],
      ),
    );
  }
}
```

</details>



<details>
  <summary>Logs</summary>

<!--
      Run your application with `flutter run --verbose` and attach all the
      log output below between the lines with the backticks. If there is an
      exception, please see if the error message includes enough information
      to explain how to solve the issue. If there is a crash, please include
      the entirety of the crash log including the backtrace.
-->

```
Launching lib/main.dart on Pixel 6 in debug mode...
Running Gradle task 'assembleDebug'...
✓  Built build/app/outputs/flutter-apk/app-debug.apk.
Installing build/app/outputs/flutter-apk/app.apk...
Debug service listening on ws://127.0.0.1:51723/T6vubx3qsPs=/ws
Syncing files to device Pixel 6...
D/CompatibilityChangeReporter(20731): Compat change id reported: 171228096; UID 10576; state: ENABLED
W/ple.webview_mix(20731): Accessing hidden method Landroid/media/AudioManager;->getOutputLatency(I)I (unsupported, reflection, allowed)
W/cr_media(20731): Requires BLUETOOTH permission
E/FrameEvents(20731): updateAcquireFence: Did not find frame.
D/CompatibilityChangeReporter(20731): Compat change id reported: 193247900; UID 10576; state: DISABLED
E/SurfaceSyncer(20731): Failed to find sync for id=0
E/FrameEvents(20731): updateAcquireFence: Did not find frame.
E/FrameEvents(20731): updateAcquireFence: Did not find frame.
I/flutter (20731): height: 11220.0
E/FrameEvents(20731): updateAcquireFence: Did not find frame.
E/FrameEvents(20731): updateAcquireFence: Did not find frame.
E/FrameEvents(20731): updateAcquireFence: Did not find frame.
I/cr_MediaCodecBridge(20731): create MediaCodec video decoder, mime video/avc
D/MediaCodecList(20731): codecHandlesFormat: no format, so no extra checks
D/MediaCodecList(20731): codecHandlesFormat: no format, so no extra checks
E/FrameEvents(20731): updateAcquireFence: Did not find frame.
D/CCodec  (20731): allocate(c2.exynos.h264.decoder)
I/Codec2Client(20731): Available Codec2 services: "default" "default1" "software"
I/CCodec  (20731): setting up 'default' as default (vendor) store
I/CCodec  (20731): Created component [c2.exynos.h264.decoder]
D/CCodecConfig(20731): read media type: video/avc
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: output.subscribed-indices.values
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: input.buffers.allocator-ids.values
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: output.buffers.allocator-ids.values
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: output.buffers.pool-ids.values
D/ReflectedParamUpdater(20731): ignored struct field coded.color-format.locations
D/CCodecConfig(20731): ignoring local param raw.size (0xd2001800) as it is already supported
D/CCodecConfig(20731): ignoring local param default.color (0x5200180b) as it is already supported
D/ReflectedParamUpdater(20731): ignored struct field raw.hdr-static-info.mastering
I/CCodecConfig(20731): query failed after returning 14 values (BAD_INDEX)
D/CCodecConfig(20731): c2 config diff is Dict {
D/CCodecConfig(20731):   c2::i32 algo.priority.value = 0
D/CCodecConfig(20731):   c2::float algo.rate.value = 0
D/CCodecConfig(20731):   c2::u32 coded.pl.level = 20496
D/CCodecConfig(20731):   c2::u32 coded.pl.profile = 20481
D/CCodecConfig(20731):   c2::u32 coded.vui.color.matrix = 0
D/CCodecConfig(20731):   c2::u32 coded.vui.color.primaries = 0
D/CCodecConfig(20731):   c2::u32 coded.vui.color.range = 0
D/CCodecConfig(20731):   c2::u32 coded.vui.color.transfer = 0
D/CCodecConfig(20731):   c2::u32 default.color.matrix = 0
D/CCodecConfig(20731):   c2::u32 default.color.primaries = 0
D/CCodecConfig(20731):   c2::u32 default.color.range = 0
D/CCodecConfig(20731):   c2::u32 default.color.transfer = 0
D/CCodecConfig(20731):   c2::u32 input.buffers.max-size.value = 7340032
D/CCodecConfig(20731):   string input.media-type.value = "video/avc"
D/CCodecConfig(20731):   c2::u32 output.delay.value = 8
D/CCodecConfig(20731):   string output.media-type.value = "video/raw"
D/CCodecConfig(20731):   c2::u32 raw.color.matrix = 0
D/CCodecConfig(20731):   c2::u32 raw.color.primaries = 0
D/CCodecConfig(20731):   c2::u32 raw.color.range = 0
D/CCodecConfig(20731):   c2::u32 raw.color.transfer = 0
D/CCodecConfig(20731):   c2::float raw.hdr-static-info.max-cll = 0
D/CCodecConfig(20731):   c2::float raw.hdr-static-info.max-fall = 0
D/CCodecConfig(20731):   c2::u32 raw.max-size.height = 240
D/CCodecConfig(20731):   c2::u32 raw.max-size.width = 320
D/CCodecConfig(20731):   c2::u32 raw.pixel-format.value = 34
D/CCodecConfig(20731):   c2::i32 raw.rotation.flip = 0
D/CCodecConfig(20731):   c2::i32 raw.rotation.value = 0
D/CCodecConfig(20731):   
W/ColorUtils(20731): expected specified color aspects (0:0:0:0)
I/MediaCodec(20731): MediaCodec will operate in async mode
D/SurfaceUtils(20731): connecting to surface 0xb4000070005862e0, reason connectToSurface
I/MediaCodec(20731): [c2.exynos.h264.decoder] setting surface generation to 21228545
D/SurfaceUtils(20731): disconnecting from surface 0xb4000070005862e0, reason connectToSurface(reconnect)
D/SurfaceUtils(20731): connecting to surface 0xb4000070005862e0, reason connectToSurface(reconnect)
D/CCodec  (20731): [c2.exynos.h264.decoder] buffers are bound to CCodec for this session
D/CCodecConfig(20731): no c2 equivalents for csd-1
D/CCodecConfig(20731): no c2 equivalents for native-window
D/CCodecConfig(20731): no c2 equivalents for flags
D/CCodecConfig(20731): c2 config diff is   c2::u32 raw.max-size.height = 1080
D/CCodecConfig(20731):   c2::u32 raw.max-size.width = 1632
D/CCodecConfig(20731):   c2::u32 raw.size.height = 1080
D/CCodecConfig(20731):   c2::u32 raw.size.width = 1632
W/Codec2Client(20731): query -- param skipped: index = 1107298332.
D/CCodec  (20731): client requested max input size 1331712, which is smaller than what component recommended (7340032); overriding with component recommendation.
W/CCodec  (20731): This behavior is subject to change. It is recommended that app developers double check whether the requested max input size is in reasonable range.
D/CCodec  (20731): encoding statistics level = 0
D/CCodec  (20731): setup formats input: AMessage(what = 0x00000000) = {
D/CCodec  (20731):   int32_t height = 1080
D/CCodec  (20731):   int32_t level = 65536
D/CCodec  (20731):   int32_t max-input-size = 7340032
D/CCodec  (20731):   string mime = "video/avc"
D/CCodec  (20731):   int32_t priority = 0
D/CCodec  (20731):   int32_t profile = 65536
D/CCodec  (20731):   int32_t width = 1632
D/CCodec  (20731):   Rect crop(0, 0, 1631, 1079)
D/CCodec  (20731): }
D/CCodec  (20731): setup formats output: AMessage(what = 0x00000000) = {
D/CCodec  (20731):   int32_t android._color-format = 2130708361
D/CCodec  (20731):   int32_t android._video-scaling = 1
D/CCodec  (20731):   int32_t rotation-degrees = 0
D/CCodec  (20731):   int32_t color-standard = 1
D/CCodec  (20731):   int32_t color-range = 2
D/CCodec  (20731):   int32_t color-transfer = 3
D/CCodec  (20731):   float cta861.max-cll = 0.000000
D/CCodec  (20731):   float cta861.max-fall = 0.000000
D/CCodec  (20731):   int32_t sar-height = 1
D/CCodec  (20731):   int32_t sar-width = 1
D/CCodec  (20731):   Rect crop(0, 0, 1631, 1079)
D/CCodec  (20731):   int32_t width = 1632
D/CCodec  (20731):   int32_t height = 1080
D/CCodec  (20731):   int32_t max-height = 1080
D/CCodec  (20731):   int32_t max-width = 1632
D/CCodec  (20731):   string mime = "video/raw"
D/CCodec  (20731):   int32_t priority = 0
D/CCodec  (20731):   int32_t android._dataspace = 260
D/CCodec  (20731):   int32_t color-format = 2130708361
D/CCodec  (20731): }
I/CCodecConfig(20731): query failed after returning 14 values (BAD_INDEX)
D/MediaCodec(20731): keep callback message for reclaim
W/Codec2Client(20731): query -- param skipped: index = 1073743886.
W/Codec2Client(20731): query -- param skipped: index = 1610614798.
W/Codec2Client(20731): query -- param skipped: index = 2684356609.
D/C2Store (20731): debug.c2.use_dmabufheaps set, forcing DMABUF Heaps
D/C2Store (20731): Using DMABUF Heaps
D/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#826] Created input block pool with allocatorID 16 => poolID 17 - OK (0)
I/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#826] Created output block pool with allocatorID 18 => poolID 133 - OK
D/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#826] Configured output block pool ids 133 => OK
D/Codec2-OutputBufferQueue(20731): remote graphic buffer migration 0/0
D/Codec2Client(20731): setOutputSurface -- failed to set consumer usage (6/BAD_INDEX)
D/Codec2Client(20731): setOutputSurface -- generation=21228545 consumer usage=0x900
D/Codec2Client(20731): Surface configure completed
I/DMABUFHEAPS(20731): Using DMA-BUF heap named: system
I/cr_MediaCodecBridge(20731): create MediaCodec video decoder, mime video/avc
D/MediaCodecList(20731): codecHandlesFormat: no format, so no extra checks
D/MediaCodecList(20731): codecHandlesFormat: no format, so no extra checks
D/CCodec  (20731): allocate(c2.exynos.h264.decoder)
I/CCodec  (20731): setting up 'default' as default (vendor) store
D/CCodecConfig(20731): c2 config diff is   c2::u32 output.delay.value = 9
I/CCodec  (20731): Created component [c2.exynos.h264.decoder]
D/Codec2-OutputBufferQueue(20731): set max dequeue count 16 from update
D/CCodecConfig(20731): read media type: video/avc
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: output.subscribed-indices.values
D/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#826] Ignoring stale input buffer done callback: last flush index = 0, frameIndex = 0
D/Codec2-OutputBufferQueue(20731): set max dequeue count 16 from update
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: input.buffers.allocator-ids.values
D/Codec2-OutputBufferQueue(20731): set max dequeue count 16 from update
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: output.buffers.allocator-ids.values
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: output.buffers.pool-ids.values
D/ReflectedParamUpdater(20731): ignored struct field coded.color-format.locations
D/CCodecConfig(20731): c2 config diff is   c2::u32 raw.crop.height = 1080
D/CCodecConfig(20731):   c2::u32 raw.crop.left = 0
D/CCodecConfig(20731):   c2::u32 raw.crop.top = 0
D/CCodecConfig(20731):   c2::u32 raw.crop.width = 1632
D/CCodecConfig(20731):   c2::u32 raw.max-size.height = 1088
D/CCodecConfig(20731):   c2::u32 raw.size.height = 1088
D/CCodecBuffers(20731): [c2.exynos.h264.decoder#826:2D-Output] popFromStashAndRegister: at 0us, output format changed to AMessage(what = 0x00000000) = {
D/CCodecBuffers(20731):   int32_t android._color-format = 2130708361
D/CCodecBuffers(20731):   int32_t android._video-scaling = 1
D/CCodecBuffers(20731):   int32_t rotation-degrees = 0
D/CCodecBuffers(20731):   int32_t color-standard = 1
D/CCodecBuffers(20731):   int32_t color-range = 2
D/CCodecBuffers(20731):   int32_t color-transfer = 3
D/CCodecBuffers(20731):   float cta861.max-cll = 0.000000
D/CCodecBuffers(20731):   float cta861.max-fall = 0.000000
D/CCodecBuffers(20731):   int32_t sar-height = 1
D/CCodecBuffers(20731):   int32_t sar-width = 1
D/CCodecBuffers(20731):   Rect crop(0, 0, 1631, 1079)
D/CCodecBuffers(20731):   int32_t width = 1632
D/CCodecBuffers(20731):   int32_t height = 1088
D/CCodecBuffers(20731):   int32_t max-height = 1088
D/CCodecBuffers(20731):   int32_t max-width = 1632
D/CCodecBuffers(20731):   string mime = "video/raw"
D/CCodecBuffers(20731):   int32_t priority = 0
D/CCodecBuffers(20731):   int32_t android._dataspace = 260
D/CCodecBuffers(20731):   int32_t color-format = 2130708361
D/CCodecBuffers(20731): }
D/CCodecConfig(20731): ignoring local param raw.size (0xd2001800) as it is already supported
D/CCodecConfig(20731): ignoring local param default.color (0x5200180b) as it is already supported
D/ReflectedParamUpdater(20731): ignored struct field raw.hdr-static-info.mastering
I/CCodecConfig(20731): query failed after returning 14 values (BAD_INDEX)
D/CCodecConfig(20731): c2 config diff is Dict {
D/CCodecConfig(20731):   c2::i32 algo.priority.value = 0
D/CCodecConfig(20731):   c2::float algo.rate.value = 0
D/CCodecConfig(20731):   c2::u32 coded.pl.level = 20496
D/CCodecConfig(20731):   c2::u32 coded.pl.profile = 20481
D/CCodecConfig(20731):   c2::u32 coded.vui.color.matrix = 0
D/CCodecConfig(20731):   c2::u32 coded.vui.color.primaries = 0
D/CCodecConfig(20731):   c2::u32 coded.vui.color.range = 0
D/CCodecConfig(20731):   c2::u32 coded.vui.color.transfer = 0
D/CCodecConfig(20731):   c2::u32 default.color.matrix = 0
D/CCodecConfig(20731):   c2::u32 default.color.primaries = 0
D/CCodecConfig(20731):   c2::u32 default.color.range = 0
D/CCodecConfig(20731):   c2::u32 default.color.transfer = 0
D/CCodecConfig(20731):   c2::u32 input.buffers.max-size.value = 7340032
D/CCodecConfig(20731):   string input.media-type.value = "video/avc"
D/CCodecConfig(20731):   c2::u32 output.delay.value = 8
D/CCodecConfig(20731):   string output.media-type.value = "video/raw"
D/CCodecConfig(20731):   c2::u32 raw.color.matrix = 0
D/CCodecConfig(20731):   c2::u32 raw.color.primaries = 0
D/CCodecConfig(20731):   c2::u32 raw.color.range = 0
D/CCodecConfig(20731):   c2::u32 raw.color.transfer = 0
D/CCodecConfig(20731):   c2::float raw.hdr-static-info.max-cll = 0
D/CCodecConfig(20731):   c2::float raw.hdr-static-info.max-fall = 0
D/CCodecConfig(20731):   c2::u32 raw.max-size.height = 240
D/CCodecConfig(20731):   c2::u32 raw.max-size.width = 320
D/CCodecConfig(20731):   c2::u32 raw.pixel-format.value = 34
D/CCodecConfig(20731):   c2::i32 raw.rotation.flip = 0
D/CCodecConfig(20731):   c2::i32 raw.rotation.value = 0
D/CCodecConfig(20731):   
W/ColorUtils(20731): expected specified color aspects (0:0:0:0)
I/MediaCodec(20731): MediaCodec will operate in async mode
D/SurfaceUtils(20731): connecting to surface 0xb400007000579680, reason connectToSurface
I/MediaCodec(20731): [c2.exynos.h264.decoder] setting surface generation to 21228546
D/SurfaceUtils(20731): disconnecting from surface 0xb400007000579680, reason connectToSurface(reconnect)
D/SurfaceUtils(20731): connecting to surface 0xb400007000579680, reason connectToSurface(reconnect)
D/CCodec  (20731): [c2.exynos.h264.decoder] buffers are bound to CCodec for this session
D/CCodecConfig(20731): no c2 equivalents for csd-1
D/CCodecConfig(20731): no c2 equivalents for native-window
D/CCodecConfig(20731): no c2 equivalents for flags
D/NdkImageReader(20731): acquireImageLocked: Overriding buffer format YUV_420_888 to 0x105.
D/CCodecConfig(20731): c2 config diff is   c2::u32 raw.max-size.height = 1080
D/CCodecConfig(20731):   c2::u32 raw.max-size.width = 1632
D/CCodecConfig(20731):   c2::u32 raw.size.height = 1080
D/CCodecConfig(20731):   c2::u32 raw.size.width = 1632
W/Codec2Client(20731): query -- param skipped: index = 1107298332.
D/CCodec  (20731): client requested max input size 1331712, which is smaller than what component recommended (7340032); overriding with component recommendation.
W/CCodec  (20731): This behavior is subject to change. It is recommended that app developers double check whether the requested max input size is in reasonable range.
D/CCodec  (20731): encoding statistics level = 0
D/CCodec  (20731): setup formats input: AMessage(what = 0x00000000) = {
D/CCodec  (20731):   int32_t height = 1080
D/CCodec  (20731):   int32_t level = 65536
D/CCodec  (20731):   int32_t max-input-size = 7340032
D/CCodec  (20731):   string mime = "video/avc"
D/CCodec  (20731):   int32_t priority = 0
D/CCodec  (20731):   int32_t profile = 65536
D/CCodec  (20731):   int32_t width = 1632
D/CCodec  (20731):   Rect crop(0, 0, 1631, 1079)
D/CCodec  (20731): }
D/CCodec  (20731): setup formats output: AMessage(what = 0x00000000) = {
D/CCodec  (20731):   int32_t android._color-format = 2130708361
D/CCodec  (20731):   int32_t android._video-scaling = 1
D/CCodec  (20731):   int32_t rotation-degrees = 0
D/CCodec  (20731):   int32_t color-standard = 1
D/CCodec  (20731):   int32_t color-range = 2
D/CCodec  (20731):   int32_t color-transfer = 3
D/CCodec  (20731):   float cta861.max-cll = 0.000000
D/CCodec  (20731):   float cta861.max-fall = 0.000000
D/CCodec  (20731):   int32_t sar-height = 1
D/CCodec  (20731):   int32_t sar-width = 1
D/CCodec  (20731):   Rect crop(0, 0, 1631, 1079)
D/CCodec  (20731):   int32_t width = 1632
D/CCodec  (20731):   int32_t height = 1080
D/CCodec  (20731):   int32_t max-height = 1080
D/CCodec  (20731):   int32_t max-width = 1632
D/CCodec  (20731):   string mime = "video/raw"
D/CCodec  (20731):   int32_t priority = 0
D/CCodec  (20731):   int32_t android._dataspace = 260
D/CCodec  (20731):   int32_t color-format = 2130708361
D/CCodec  (20731): }
I/CCodecConfig(20731): query failed after returning 14 values (BAD_INDEX)
D/MediaCodec(20731): keep callback message for reclaim
W/Codec2Client(20731): query -- param skipped: index = 1073743886.
W/Codec2Client(20731): query -- param skipped: index = 1610614798.
W/Codec2Client(20731): query -- param skipped: index = 2684356609.
D/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#889] Created input block pool with allocatorID 16 => poolID 18 - OK (0)
I/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#889] Created output block pool with allocatorID 18 => poolID 134 - OK
D/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#889] Configured output block pool ids 134 => OK
D/Codec2-OutputBufferQueue(20731): remote graphic buffer migration 0/0
D/Codec2Client(20731): setOutputSurface -- failed to set consumer usage (6/BAD_INDEX)
D/Codec2Client(20731): setOutputSurface -- generation=21228546 consumer usage=0x900
D/Codec2Client(20731): Surface configure completed
I/cr_MediaCodecBridge(20731): create MediaCodec video decoder, mime video/avc
D/MediaCodecList(20731): codecHandlesFormat: no format, so no extra checks
D/MediaCodecList(20731): codecHandlesFormat: no format, so no extra checks
D/CCodec  (20731): allocate(c2.exynos.h264.decoder)
I/CCodec  (20731): setting up 'default' as default (vendor) store
I/CCodec  (20731): Created component [c2.exynos.h264.decoder]
D/CCodecConfig(20731): read media type: video/avc
D/CCodecConfig(20731): c2 config diff is   c2::u32 output.delay.value = 9
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: output.subscribed-indices.values
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: input.buffers.allocator-ids.values
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: output.buffers.allocator-ids.values
D/ReflectedParamUpdater(20731): extent() != 1 for single value type: output.buffers.pool-ids.values
D/Codec2-OutputBufferQueue(20731): set max dequeue count 16 from update
D/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#889] Ignoring stale input buffer done callback: last flush index = 0, frameIndex = 0
D/Codec2-OutputBufferQueue(20731): set max dequeue count 16 from update
D/Codec2-OutputBufferQueue(20731): set max dequeue count 16 from update
D/ReflectedParamUpdater(20731): ignored struct field coded.color-format.locations
D/CCodecConfig(20731): ignoring local param raw.size (0xd2001800) as it is already supported
D/CCodecConfig(20731): ignoring local param default.color (0x5200180b) as it is already supported
D/ReflectedParamUpdater(20731): ignored struct field raw.hdr-static-info.mastering
I/CCodecConfig(20731): query failed after returning 14 values (BAD_INDEX)
D/CCodecConfig(20731): c2 config diff is Dict {
D/CCodecConfig(20731):   c2::i32 algo.priority.value = 0
D/CCodecConfig(20731):   c2::float algo.rate.value = 0
D/CCodecConfig(20731):   c2::u32 coded.pl.level = 20496
D/CCodecConfig(20731):   c2::u32 coded.pl.profile = 20481
D/CCodecConfig(20731):   c2::u32 coded.vui.color.matrix = 0
D/CCodecConfig(20731):   c2::u32 coded.vui.color.primaries = 0
D/CCodecConfig(20731):   c2::u32 coded.vui.color.range = 0
D/CCodecConfig(20731):   c2::u32 coded.vui.color.transfer = 0
D/CCodecConfig(20731):   c2::u32 default.color.matrix = 0
D/CCodecConfig(20731):   c2::u32 default.color.primaries = 0
D/CCodecConfig(20731):   c2::u32 default.color.range = 0
D/CCodecConfig(20731):   c2::u32 default.color.transfer = 0
D/CCodecConfig(20731):   c2::u32 input.buffers.max-size.value = 7340032
D/CCodecConfig(20731):   string input.media-type.value = "video/avc"
D/CCodecConfig(20731):   c2::u32 output.delay.value = 8
D/CCodecConfig(20731):   string output.media-type.value = "video/raw"
D/CCodecConfig(20731):   c2::u32 raw.color.matrix = 0
D/CCodecConfig(20731):   c2::u32 raw.color.primaries = 0
D/CCodecConfig(20731):   c2::u32 raw.color.range = 0
D/CCodecConfig(20731):   c2::u32 raw.color.transfer = 0
D/CCodecConfig(20731):   c2::float raw.hdr-static-info.max-cll = 0
D/CCodecConfig(20731):   c2::float raw.hdr-static-info.max-fall = 0
D/CCodecConfig(20731):   c2::u32 raw.max-size.height = 240
D/CCodecConfig(20731):   c2::u32 raw.max-size.width = 320
D/CCodecConfig(20731):   c2::u32 raw.pixel-format.value = 34
D/CCodecConfig(20731):   c2::i32 raw.rotation.flip = 0
D/CCodecConfig(20731):   c2::i32 raw.rotation.value = 0
D/CCodecConfig(20731):   
W/ColorUtils(20731): expected specified color aspects (0:0:0:0)
D/CCodecConfig(20731): c2 config diff is   c2::u32 raw.crop.height = 1080
D/CCodecConfig(20731):   c2::u32 raw.crop.left = 0
D/CCodecConfig(20731):   c2::u32 raw.crop.top = 0
D/CCodecConfig(20731):   c2::u32 raw.crop.width = 1632
D/CCodecConfig(20731):   c2::u32 raw.max-size.height = 1088
D/CCodecConfig(20731):   c2::u32 raw.size.height = 1088
D/CCodecBuffers(20731): [c2.exynos.h264.decoder#889:2D-Output] popFromStashAndRegister: at 0us, output format changed to AMessage(what = 0x00000000) = {
D/CCodecBuffers(20731):   int32_t android._color-format = 2130708361
D/CCodecBuffers(20731):   int32_t android._video-scaling = 1
D/CCodecBuffers(20731):   int32_t rotation-degrees = 0
D/CCodecBuffers(20731):   int32_t color-standard = 1
D/CCodecBuffers(20731):   int32_t color-range = 2
D/CCodecBuffers(20731):   int32_t color-transfer = 3
D/CCodecBuffers(20731):   float cta861.max-cll = 0.000000
D/CCodecBuffers(20731):   float cta861.max-fall = 0.000000
D/CCodecBuffers(20731):   int32_t sar-height = 1
D/CCodecBuffers(20731):   int32_t sar-width = 1
D/CCodecBuffers(20731):   Rect crop(0, 0, 1631, 1079)
D/CCodecBuffers(20731):   int32_t width = 1632
D/CCodecBuffers(20731):   int32_t height = 1088
D/CCodecBuffers(20731):   int32_t max-height = 1088
D/CCodecBuffers(20731):   int32_t max-width = 1632
D/CCodecBuffers(20731):   string mime = "video/raw"
D/CCodecBuffers(20731):   int32_t priority = 0
D/CCodecBuffers(20731):   int32_t android._dataspace = 260
D/CCodecBuffers(20731):   int32_t color-format = 2130708361
D/CCodecBuffers(20731): }
I/MediaCodec(20731): MediaCodec will operate in async mode
D/NdkImageReader(20731): acquireImageLocked: Overriding buffer format YUV_420_888 to 0x105.
D/SurfaceUtils(20731): connecting to surface 0xb400007000581ec0, reason connectToSurface
I/MediaCodec(20731): [c2.exynos.h264.decoder] setting surface generation to 21228547
D/SurfaceUtils(20731): disconnecting from surface 0xb400007000581ec0, reason connectToSurface(reconnect)
D/SurfaceUtils(20731): connecting to surface 0xb400007000581ec0, reason connectToSurface(reconnect)
D/CCodec  (20731): [c2.exynos.h264.decoder] buffers are bound to CCodec for this session
D/CCodecConfig(20731): no c2 equivalents for csd-1
D/CCodecConfig(20731): no c2 equivalents for native-window
D/CCodecConfig(20731): no c2 equivalents for flags
D/CCodecConfig(20731): c2 config diff is   c2::u32 raw.max-size.height = 1080
D/CCodecConfig(20731):   c2::u32 raw.max-size.width = 1632
D/CCodecConfig(20731):   c2::u32 raw.size.height = 1080
D/CCodecConfig(20731):   c2::u32 raw.size.width = 1632
W/Codec2Client(20731): query -- param skipped: index = 1107298332.
D/CCodec  (20731): client requested max input size 1331712, which is smaller than what component recommended (7340032); overriding with component recommendation.
W/CCodec  (20731): This behavior is subject to change. It is recommended that app developers double check whether the requested max input size is in reasonable range.
D/CCodec  (20731): encoding statistics level = 0
D/CCodec  (20731): setup formats input: AMessage(what = 0x00000000) = {
D/CCodec  (20731):   int32_t height = 1080
D/CCodec  (20731):   int32_t level = 65536
D/CCodec  (20731):   int32_t max-input-size = 7340032
D/CCodec  (20731):   string mime = "video/avc"
D/CCodec  (20731):   int32_t priority = 0
D/CCodec  (20731):   int32_t profile = 65536
D/CCodec  (20731):   int32_t width = 1632
D/CCodec  (20731):   Rect crop(0, 0, 1631, 1079)
D/CCodec  (20731): }
D/CCodec  (20731): setup formats output: AMessage(what = 0x00000000) = {
D/CCodec  (20731):   int32_t android._color-format = 2130708361
D/CCodec  (20731):   int32_t android._video-scaling = 1
D/CCodec  (20731):   int32_t rotation-degrees = 0
D/CCodec  (20731):   int32_t color-standard = 1
D/CCodec  (20731):   int32_t color-range = 2
D/CCodec  (20731):   int32_t color-transfer = 3
D/CCodec  (20731):   float cta861.max-cll = 0.000000
D/CCodec  (20731):   float cta861.max-fall = 0.000000
D/CCodec  (20731):   int32_t sar-height = 1
D/CCodec  (20731):   int32_t sar-width = 1
D/CCodec  (20731):   Rect crop(0, 0, 1631, 1079)
D/CCodec  (20731):   int32_t width = 1632
D/CCodec  (20731):   int32_t height = 1080
D/CCodec  (20731):   int32_t max-height = 1080
D/CCodec  (20731):   int32_t max-width = 1632
D/CCodec  (20731):   string mime = "video/raw"
D/CCodec  (20731):   int32_t priority = 0
D/CCodec  (20731):   int32_t android._dataspace = 260
D/CCodec  (20731):   int32_t color-format = 2130708361
D/CCodec  (20731): }
I/CCodecConfig(20731): query failed after returning 14 values (BAD_INDEX)
D/MediaCodec(20731): keep callback message for reclaim
W/Codec2Client(20731): query -- param skipped: index = 1073743886.
W/Codec2Client(20731): query -- param skipped: index = 1610614798.
W/Codec2Client(20731): query -- param skipped: index = 2684356609.
D/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#772] Created input block pool with allocatorID 16 => poolID 19 - OK (0)
I/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#772] Created output block pool with allocatorID 18 => poolID 135 - OK
D/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#772] Configured output block pool ids 135 => OK
D/Codec2-OutputBufferQueue(20731): remote graphic buffer migration 0/0
D/Codec2Client(20731): setOutputSurface -- failed to set consumer usage (6/BAD_INDEX)
D/Codec2Client(20731): setOutputSurface -- generation=21228547 consumer usage=0x900
D/Codec2Client(20731): Surface configure completed
D/CCodecConfig(20731): c2 config diff is   c2::u32 output.delay.value = 9
D/Codec2-OutputBufferQueue(20731): set max dequeue count 16 from update
D/CCodecBufferChannel(20731): [c2.exynos.h264.decoder#772] Ignoring stale input buffer done callback: last flush index = 0, frameIndex = 0
D/Codec2-OutputBufferQueue(20731): set max dequeue count 16 from update
D/Codec2-OutputBufferQueue(20731): set max dequeue count 16 from update
D/CCodecConfig(20731): c2 config diff is   c2::u32 raw.crop.height = 1080
D/CCodecConfig(20731):   c2::u32 raw.crop.left = 0
D/CCodecConfig(20731):   c2::u32 raw.crop.top = 0
D/CCodecConfig(20731):   c2::u32 raw.crop.width = 1632
D/CCodecConfig(20731):   c2::u32 raw.max-size.height = 1088
D/CCodecConfig(20731):   c2::u32 raw.size.height = 1088
D/CCodecBuffers(20731): [c2.exynos.h264.decoder#772:2D-Output] popFromStashAndRegister: at 0us, output format changed to AMessage(what = 0x00000000) = {
D/CCodecBuffers(20731):   int32_t android._color-format = 2130708361
D/CCodecBuffers(20731):   int32_t android._video-scaling = 1
D/CCodecBuffers(20731):   int32_t rotation-degrees = 0
D/CCodecBuffers(20731):   int32_t color-standard = 1
D/CCodecBuffers(20731):   int32_t color-range = 2
D/CCodecBuffers(20731):   int32_t color-transfer = 3
D/CCodecBuffers(20731):   float cta861.max-cll = 0.000000
D/CCodecBuffers(20731):   float cta861.max-fall = 0.000000
D/CCodecBuffers(20731):   int32_t sar-height = 1
D/CCodecBuffers(20731):   int32_t sar-width = 1
D/CCodecBuffers(20731):   Rect crop(0, 0, 1631, 1079)
D/CCodecBuffers(20731):   int32_t width = 1632
D/CCodecBuffers(20731):   int32_t height = 1088
D/CCodecBuffers(20731):   int32_t max-height = 1088
D/CCodecBuffers(20731):   int32_t max-width = 1632
D/CCodecBuffers(20731):   string mime = "video/raw"
D/CCodecBuffers(20731):   int32_t priority = 0
D/CCodecBuffers(20731):   int32_t android._dataspace = 260
D/CCodecBuffers(20731):   int32_t color-format = 2130708361
D/CCodecBuffers(20731): }
D/NdkImageReader(20731): acquireImageLocked: Overriding buffer format YUV_420_888 to 0x105.
I/flutter (20731): use height: 11220.0
I/scudo   (20731): Scudo ERROR: invalid chunk state when deallocating address 0x200006f5046ee90
F/libc    (20731): Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 20751 (RenderThread), pid 20731 (ple.webview_mix)
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'google/oriole/oriole:13/TPB3.220617.002/8759250:user/release-keys'
Revision: 'MP1.0'
ABI: 'arm64'
Timestamp: 2022-07-02 21:10:28.878243818+0800
Process uptime: 4s
Cmdline: com.example.webview_mix
pid: 20731, tid: 20751, name: RenderThread  >>> com.example.webview_mix <<<
uid: 10576
tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
Abort message: 'Scudo ERROR: invalid chunk state when deallocating address 0x200006f5046ee90'
    x0  0000000000000000  x1  000000000000510f  x2  0000000000000006  x3  0000006e050612e0
    x4  0000000000808080  x5  0000000000808080  x6  0000000000808080  x7  8080808080808080
    x8  00000000000000f0  x9  000000712f1b49e0  x10 0000000000000001  x11 000000712f1f55e0
    x12 0101010101010101  x13 000000007fffffff  x14 00000000046fb8a2  x15 0000000000000030
    x16 000000712f262d58  x17 000000712f23e120  x18 0000006e04836000  x19 00000000000050fb
    x20 000000000000510f  x21 00000000ffffffff  x22 0000000000000000  x23 0000006e050617b0
    x24 b400006f304931d0  x25 0000000000000001  x26 0000000000000000  x27 0000006e05062000
    x28 b40000706047b1d8  x29 0000006e05061360
    lr  000000712f1e60c8  sp  0000006e050612c0  pc  000000712f1e60f4  pst 0000000000001000
backtrace:
      #00 pc 00000000000530f4  /apex/com.android.runtime/lib64/bionic/libc.so (abort+164) (BuildId: cbc4c62a9b269839456f1d7728d8411e)
      #01 pc 00000000000417b8  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::die()+8) (BuildId: cbc4c62a9b269839456f1d7728d8411e)
      #02 pc 0000000000042160  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::ScopedErrorReport::~ScopedErrorReport()+32) (BuildId: cbc4c62a9b269839456f1d7728d8411e)
      #03 pc 0000000000042504  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::reportInvalidChunkState(scudo::AllocatorAction, void*)+116) (BuildId: cbc4c62a9b269839456f1d7728d8411e)
      #04 pc 0000000000044064  /apex/com.android.runtime/lib64/bionic/libc.so (scudo::Allocator<scudo::AndroidConfig, &(scudo_malloc_postinit)>::deallocate(void*, scudo::Chunk::Origin, unsigned long, unsigned long)+308) (BuildId: cbc4c62a9b269839456f1d7728d8411e)
      #05 pc 00000000007663e4  /vendor/lib64/egl/libGLES_mali.so (vulkan::image::~image()+212) (BuildId: ae75a6e293b6843d)
      #06 pc 00000000007653e8  /vendor/lib64/egl/libGLES_mali.so (vkDestroyImage+40) (BuildId: ae75a6e293b6843d)
      #07 pc 000000000062fdd0  /system/lib64/libhwui.so (GrAHardwareBufferUtils::VulkanCleanupHelper::~VulkanCleanupHelper()+32) (BuildId: 9fc5597d745a01b0148410f3fa271122)
      #08 pc 000000000062fd94  /system/lib64/libhwui.so (GrAHardwareBufferUtils::delete_vk_image(void*)+20) (BuildId: 9fc5597d745a01b0148410f3fa271122)
      #09 pc 00000000006f5838  /system/lib64/libhwui.so (SkSurface::MakeFromAHardwareBuffer(GrDirectContext*, AHardwareBuffer*, GrSurfaceOrigin, sk_sp<SkColorSpace>, SkSurfaceProps const*, bool)+392) (BuildId: 9fc5597d745a01b0148410f3fa271122)
      #10 pc 000000000058445c  /system/lib64/libhwui.so (android::uirenderer::renderthread::VulkanSurface::dequeueNativeBuffer()+796) (BuildId: 9fc5597d745a01b0148410f3fa271122)
      #11 pc 0000000000583f14  /system/lib64/libhwui.so (android::uirenderer::renderthread::VulkanManager::dequeueNextBuffer(android::uirenderer::renderthread::VulkanSurface*)+52) (BuildId: 9fc5597d745a01b0148410f3fa271122)
      #12 pc 0000000000439e64  /system/lib64/libhwui.so (android::uirenderer::renderthread::CanvasContext::draw()+340) (BuildId: 9fc5597d745a01b0148410f3fa271122)
      #13 pc 00000000004b5664  /system/lib64/libhwui.so (std::__1::__function::__func<android::uirenderer::renderthread::DrawFrameTask::postAndWait()::$_0, std::__1::allocator<android::uirenderer::renderthread::DrawFrameTask::postAndWait()::$_0>, void ()>::operator()() (.__uniq.264041412789356548918088680803242235290.c1671e787f244890c877724752face20)+644) (BuildId: 9fc5597d745a01b0148410f3fa271122)
      #14 pc 000000000058adb4  /system/lib64/libhwui.so (android::uirenderer::renderthread::RenderThread::threadLoop()+644) (BuildId: 9fc5597d745a01b0148410f3fa271122)
      #15 pc 00000000000147f0  /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+528) (BuildId: 0b4a793fa8045c04066d988c68bac8bb)
      #16 pc 00000000000c14dc  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204) (BuildId: cbc4c62a9b269839456f1d7728d8411e)
      #17 pc 0000000000054930  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: cbc4c62a9b269839456f1d7728d8411e)
```

<!--
     Run `flutter analyze` and attach any output of that command below.
     If there are any analysis errors, try resolving them before filing this issue.
-->

```
```

<!-- Finally, paste the output of running `flutter doctor -v` here. -->

```
```

</details>


<!--
      Consider also attaching screenshots and/or videos to better
      illustrate the issue.

      You can upload them directly on GitHub.
      Beware that video file size is limited to 10MB.
-->