[Google3 Bug] _TypeError crash in _RenderObjectSemantics._buildSemanticsSubtree #184036

Activity

1. math1man

   added

   customer: googleVarious Google teamsVarious Google teams

   on Mar 23, 2026
2. math1man commented on Mar 23, 2026

   

   math1man

   on Mar 23, 2026

   ContributorAuthor

   More actions

   Internal bug b/494797304, client huggsy
3. mbcorona

   added

   in triagePresently being triaged by the triage teamPresently being triaged by the triage team

   c: crashStack traces logged to the consoleStack traces logged to the console

   frameworkflutter/packages/flutter repository. See also f: labels.flutter/packages/flutter repository. See also f: labels.

   a: accessibilityAccessibility, e.g. VoiceOver or TalkBack. (aka a11y)Accessibility, e.g. VoiceOver or TalkBack. (aka a11y)

   team-accessibilityOwned by Framework Accessibility team (i.e. responsible for accessibility code in flutter/flutter)Owned by Framework Accessibility team (i.e. responsible for accessibility code in flutter/flutter)

   and removed

   in triagePresently being triaged by the triage teamPresently being triaged by the triage team

   on Mar 23, 2026
4. mbcorona commented on Mar 23, 2026

   

   mbcorona

   on Mar 23, 2026

   Member

   More actions

   Routing to team-accessibility since the stack trace specifically fails at _RenderObjectSemantics._buildSemanticsSubtree
5. mbcorona

   changed the title [-][Google3 Bug]:[/-] [+][Google3 Bug] _TypeError crash in _RenderObjectSemantics._buildSemanticsSubtree[/+] on Mar 23, 2026
6. chunhtai

   self-assigned this

   on Mar 25, 2026
7. chunhtai

   added

   P1High-priority issues at the top of the work listHigh-priority issues at the top of the work list

   triaged-accessibilityTriaged by Framework Accessibility teamTriaged by Framework Accessibility team

   on Mar 25, 2026
8. chunhtai commented on Mar 27, 2026

   

   chunhtai

   on Mar 27, 2026

   Contributor

   More actions

   Response from AI assistant:

   This is a valid accessibility bug in the Flutter framework, causing a _TypeError crash at _RenderObjectSemantics._buildSemanticsSubtree (object.dart:6235) when a semantic node enters a siblingMergeGroups with a dirty (null) geometry. Because updateChildren() fails to schedule an explicit child within a siblingMergeGroups for a geometry update, it cascades to a null assertion runtime failure.

   1. Reproducible Test Case

   import 'package:flutter/material.dart';
   import 'package:flutter/rendering.dart';
   import 'package:flutter_test/flutter_test.dart';
   
   void main() {
     testWidgets('Reproduce null geometry in siblingMergeGroups', (WidgetTester tester) async {
       const SemanticsTag first = SemanticsTag('1');
       const SemanticsTag second = SemanticsTag('2');
       ChildSemanticsConfigurationsResult delegate(List<SemanticsConfiguration> configs) {
         final ChildSemanticsConfigurationsResultBuilder builder = ChildSemanticsConfigurationsResultBuilder();
         final List<SemanticsConfiguration> sibling = <SemanticsConfiguration>[];
         for (final SemanticsConfiguration config in configs) {
           if (config.tagsChildrenWith(first) || config.tagsChildrenWith(second)) {
             sibling.add(config);
           } else {
             builder.markAsMergeUp(config);
           }
         }
         builder.markAsSiblingMergeGroup(sibling);
         return builder.build();
       }
   
       final StateSetterBuilder parentSetter = StateSetterBuilder();
       double size = 100.0;
   
       await tester.pumpWidget(
         Directionality(
           textDirection: TextDirection.ltr,
           child: Semantics(
             label: 'parent',
             child: parentSetter.build(
               (BuildContext context, void Function(void Function()) setState) {
                 return SizedBox(
                   width: size,
                   height: size,
                   child: TestConfigDelegate(
                     delegate: delegate,
                     child: Column(
                       children: <Widget>[
                         Semantics(label: '1', tagForChildren: first, child: const SizedBox(width: 10, height: 10)),
                         Semantics(label: '2', tagForChildren: second, child: const SizedBox(width: 10, height: 10)),
                       ],
                     ),
                   ),
                 );
               },
             ),
           ),
         ),
       );
   
       // Now trigger markNeedsSemanticsGeometryUpdate on the parent.
       // Changing the size of the outer SizedBox will make the tree structurally dirty for geometry.
       parentSetter.update(() {
         size = 200.0;
       });
       
       // The framework will run flushSemantics.
       await tester.pump();
     });
   }
   
   class StateSetterBuilder {
     void Function(void Function())? _setState;
     Widget build(Widget Function(BuildContext, void Function(void Function())) builder) {
       return StatefulBuilder(
         builder: (BuildContext context, void Function(void Function()) setState) {
           _setState = setState;
           return builder(context, setState);
         },
       );
     }
     void update(void Function() fn) {
       _setState!(fn);
     }
   }
   
   class TestConfigDelegate extends SingleChildRenderObjectWidget {
     const TestConfigDelegate({super.key, required this.delegate, super.child});
     final ChildSemanticsConfigurationsDelegate delegate;
   
     @override
     RenderTestConfigDelegate createRenderObject(BuildContext context) =>
         RenderTestConfigDelegate(delegate: delegate);
   
     @override
     void updateRenderObject(BuildContext context, RenderTestConfigDelegate renderObject) {
       if (renderObject.delegate != delegate) {
         renderObject.delegate = delegate;
         renderObject.markNeedsSemanticsUpdate();
       }
     }
   }
   
   class RenderTestConfigDelegate extends RenderProxyBox {
     RenderTestConfigDelegate({required ChildSemanticsConfigurationsDelegate delegate}) : _delegate = delegate;
   
     ChildSemanticsConfigurationsDelegate get delegate => _delegate;
     ChildSemanticsConfigurationsDelegate _delegate;
     set delegate(ChildSemanticsConfigurationsDelegate value) {
       if (value != _delegate) {
         _delegate = value;
         markNeedsSemanticsUpdate();
       }
     }
   
     @override
     void describeSemanticsConfiguration(SemanticsConfiguration config) {
       super.describeSemanticsConfiguration(config);
       config.childConfigurationsDelegate = delegate;
     }
   }

   2. Proposed Fix in Framework (packages/flutter/lib/src/rendering/object.dart)

   In _RenderObjectSemantics.updateChildren(), iterate over elements inside siblingMergeGroups and check for missing geometry. If found, add them to _nodesNeedingSemanticsGeometryUpdate list:

       // Current loop in updateChildren handles result.$1 (mergeUp group):
       for (final _RenderObjectSemantics childSemantics
           in result.$1.whereType<_RenderObjectSemantics>()) {
           if (childSemantics.geometryDirty) {
             renderObject.owner!._nodesNeedingSemanticsGeometryUpdate.add(childSemantics.renderObject);
           }
           // ... evaluates nodes in mergeUp group
       }
   
       // proposed addition directly after the above:
       for (final _RenderObjectSemantics explicitSiblingChild
           in siblingMergeGroups
               .expand<_SemanticsFragment>((List<_SemanticsFragment> group) => group)
               .whereType<_RenderObjectSemantics>()
               .expand(
                 (_RenderObjectSemantics siblingChild) => siblingChild.shouldFormSemanticsNode
                     ? <_RenderObjectSemantics>[siblingChild]
                     : siblingChild._children,
               )) {
         if (explicitSiblingChild.geometryDirty) {
           renderObject.owner!._nodesNeedingSemanticsGeometryUpdate.add(explicitSiblingChild.renderObject);
         }
       }

   Component: framework
   Labels needed: framework
9. github-merge-queue

   added a commit that references this issue on Mar 30, 2026

   fixes crash when invisible semantics nodes dropped from semantics tree (

   ...

   6f07097
10. auto-submit

    closed this as completedin #184226on Mar 30, 2026
11. github-actions commented on Apr 13, 2026

    

    github-actionsbot

    on Apr 13, 2026 – with GitHub Actions

    More actions

    This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.
12. github-actions

    locked as resolved and limited conversation to collaborators on Apr 13, 2026
13. ahmedsameha1

    added a commit that references this issue on Apr 14, 2026

    fixes crash when invisible semantics nodes dropped from semantics tree (

    ...

    8d27823
14. Nakiha

    added a commit that references this issue on Sep 28, 2026

    fixes crash when invisible semantics nodes dropped from semantics tre…

    ...

    a5693c4