crash in certain cases when enabling search promo using loading favourite sites from NTP - follow up to #25059

[kjozwiak]

Description

Appears that we have another crash that's very similar/related to #25059. However, with this one, you don't even need to enable Show suggested sites in autocomplete. If you open one of the websites via the favourite twice and click/tap the omnibox, you'll get an instant crash. Some examples of the crashes:

• 355e0800-e66e-bc08-0000-000000000000
• 0a5e0800-e66e-bc08-0000-000000000000
• 025e0800-e66e-bc08-0000-000000000000

Steps to Reproduce

Prerequisite: ensure that you're part of either US, CA, DE, FR, UK, AT, ES or MX

1. launch with a clean profile and run through onboarding (in this case, I set Brave as the default browser)
2. go into Settings -> Search engines and change the Standard tab to something else other than Brave
3. go into Developer options -> QA Preferences
4. tap on Command Line String and add --enable-features=BraveSearchOmniboxBanner (tap on Relaunch Now)
5. click on any of the favourites that are loaded via the NTP
6. once the page loads, click on the omnibox and you should see the brave search promo
7. open a new tab and click on the same favourite via the NTP and tap on the omnibox once the website finishes loading

You'll get an instant crash 100% of the time while running through the above STR/Cases. Attached a video below for an example.

Actual result:

Screen_Recording_20220830-174642_Brave.-.Nightly.mp4

Expected result:

Brave shouldn't be crashing when users tap on the omnibox when they have --enable-features=BraveSearchOmniboxBanner enabled

Reproduces how often:

100% reproducible using the STR/Cases mentioned above.

Brave version (brave://version info)

Brave | 1.45.12 Chromium: 105.0.5195.68 (Official Build) canary (32-bit)
--- | ---
Revision | ad13e82529051bac6a0e65f455e6d7a1e5fd7938-refs/branch-heads/5195@{#903}
OS | Android 12; Build/SP1A.210812.016

Version/Channel Information:

• Can you reproduce this issue with the current release? N/A
• Can you reproduce this issue with the beta channel? N/A
• Can you reproduce this issue with the nightly channel? Yes

However, all channels will be affected once brave/brave-core#14542 has been merged into 1.43.x.

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? N/A
• Does the issue resolve itself when disabling Brave Rewards? N/A
• Is the issue reproducible on the latest version of Chrome? N/A

Miscellaneous Information:

[kjozwiak]

Adding the crash stack that @samartnik posted/added via Slack:

java.lang.ClassCastException: android.widget.FrameLayout$LayoutParams cannot be cast to T92
	at androidx.recyclerview.widget.RecyclerView.getChildViewHolderInt(RecyclerView.java:5284)
	at androidx.recyclerview.widget.RecyclerView$LayoutManager.findViewByPosition(RecyclerView.java:9461)
	at androidx.recyclerview.widget.LinearLayoutManager.findViewByPosition(LinearLayoutManager.java:434)
	at org.chromium.chrome.browser.omnibox.suggestions.OmniboxSuggestionsDropdownAdapter.setSelectedViewIndex(OmniboxSuggestionsDropdownAdapter.java:84)
	at org.chromium.chrome.browser.omnibox.suggestions.OmniboxSuggestionsDropdownAdapter.resetSelection(OmniboxSuggestionsDropdownAdapter.java:69)
	at org.chromium.chrome.browser.omnibox.suggestions.OmniboxSuggestionsDropdown.show(OmniboxSuggestionsDropdown.java:255)
	at org.chromium.chrome.browser.omnibox.suggestions.SuggestionListViewBinder.bind(SuggestionListViewBinder.java:46)
	at org.chromium.ui.modelutil.LazyConstructionPropertyMcp.flushPendingUpdates(LazyConstructionPropertyMcp.java:82)
	at org.chromium.ui.modelutil.LazyConstructionPropertyMcp.onPropertyChanged(LazyConstructionPropertyMcp.java:107)
	at org.chromium.ui.modelutil.PropertyObservable.notifyPropertyChanged(PropertyObservable.java:68)
	at org.chromium.ui.modelutil.PropertyModel.set(PropertyModel.java:384)
	at org.chromium.chrome.browser.omnibox.suggestions.AutocompleteMediator.updateOmniboxSuggestionsVisibility(AutocompleteMediator.java:877)
	at org.chromium.chrome.browser.omnibox.suggestions.AutocompleteMediator.onUrlAnimationFinished(AutocompleteMediator.java:342)
	at org.chromium.chrome.browser.omnibox.suggestions.AutocompleteCoordinator.onUrlAnimationFinished(AutocompleteCoordinator.java:241)
	at org.chromium.chrome.browser.omnibox.LocationBarMediator.setUrlFocusChangeInProgress(LocationBarMediator.java:628)
	at org.chromium.chrome.browser.omnibox.LocationBarMediator.finishUrlFocusChange(LocationBarMediator.java:646)
	at org.chromium.chrome.browser.omnibox.LocationBarCoordinator.finishUrlFocusChange(LocationBarCoordinator.java:533)
	at org.chromium.chrome.browser.toolbar.top.ToolbarPhone$9.onEnd(ToolbarPhone.java:2185)
	at org.chromium.components.browser_ui.widget.animation.CancelAwareAnimatorListener.onAnimationEnd(CancelAwareAnimatorListener.java:38)
	at android.animation.Animator$AnimatorListener.onAnimationEnd(Animator.java:555)
	at android.animation.AnimatorSet.endAnimation(AnimatorSet.java:1301)
	at android.animation.AnimatorSet.doAnimationFrame(AnimatorSet.java:1086)
	at android.animation.AnimationHandler.doAnimationFrame(AnimationHandler.java:146)
	at android.animation.AnimationHandler.access$100(AnimationHandler.java:37)
	at android.animation.AnimationHandler$1.doFrame(AnimationHandler.java:54)
	at android.view.Choreographer$CallbackRecord.run(Choreographer.java:1106)
	at android.view.Choreographer.doCallbacks(Choreographer.java:866)
	at android.view.Choreographer.doFrame(Choreographer.java:792)
	at android.view.Choreographer$FrameDisplayEventReceiver.run(Choreographer.java:1092)
	at android.os.Handler.handleCallback(Handler.java:938)
	at android.os.Handler.dispatchMessage(Handler.java:99)
	at android.os.Looper.loopOnce(Looper.java:226)
	at android.os.Looper.loop(Looper.java:313)
	at android.app.ActivityThread.main(ActivityThread.java:8663)
	at java.lang.reflect.Method.invoke(Native Method)
	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:567)
	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1135)

[kjozwiak]

Added the android-phone-specific label as both @Uni-verse and myself can't reproduce in tablets but can reproduce the crash via mobile. I went through the following devices:

• Samsung S10+ running Android 12 - Reproduced
• Samsung S8 Ultra Tablet running Android 12 - Can't reproduce
• Pixel 6 running Android 13 - Reproduced

[kjozwiak]

Verification PASSED on Samsung S10+ running Android 12 using the following build(s):

Brave | 1.43.87 Chromium: 105.0.5195.68 (Official Build) (32-bit)
--- | ---
Revision | ad13e82529051bac6a0e65f455e6d7a1e5fd7938-refs/branch-heads/5195@{#903}
OS | Android 12; Build/SP1A.210812.016

Screen_Recording_20220831-183501_Brave.mp4