Bug 29983 - chromium - segfaults when closing incognito window erroneously closes both windows
Summary: chromium - segfaults when closing incognito window erroneously closes both wi...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 8
Hardware: x86_64 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Christiaan Welvaart
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-02-01 15:50 CET by Edward
Modified: 2022-03-17 09:37 CET (History)
4 users (show)

See Also:
Source RPM: chromium-browser-stable-96.0.4664.110-1.mga8.src.rpm
CVE:
Status comment:


Attachments

Description Edward 2022-02-01 15:50:10 CET
Description of problem:

Chromium is segfaulting when closing an Incognito window, which erroneously closes both Chromium windows. 


Version-Release number of selected component (if applicable):

96.0.4664.110


How reproducible:

Launch Chromium, open Incognito window. Browse as normal. Close Incognito window by clicking the X in the upper right corner, both Incognito and normal Chromium windows close at the same time, resulting in a segfault.

See: https://forums.mageia.org/en/viewtopic.php?f=7&t=14415#p85018 (Text of terminal output when run from a terminal window, showing the segfault and stack trace at the end.)
Comment 1 David Walser 2022-02-01 18:31:18 CET
I can't reproduce this with 97.0.4692.99, the update in Bug 29846.
Comment 2 katnatek 2022-02-01 19:44:47 CET
(In reply to David Walser from comment #1)
> I can't reproduce this with 97.0.4692.99, the update in Bug 29846.

Test with same version as David in real hardware (Mageia 8 Plasma i586)
The bug is not reproducible
Comment 3 Morgan Leijström 2022-02-01 21:18:34 CET
@Edward, please try with the new version currently in testing.

CC: (none) => fri

Comment 4 Lewis Smith 2022-02-01 21:39:22 CET
Thank you Edwrd for the report; and DavidW & katnatek for their checks - if with the next incarnation of this browser.

Trying this on real x64 hardware, Mate. Installed against my better judgement:
 chromium-browser-stable-96.0.4664.110-1.mga8   [same as Edward]

Launch the browser. It opens with 2 'normal' tabs, one labeled 'New Tab'.
Browse in one of them. [Adverts!]
From the RH discreet 3-vertical-dots menu, opened a new 'Incognito' window.
Browsed in that.
Closed it with the top right 'X'.
It disappeared, leaving the original normal window (2 tabs) intact.

So fault unconfirmed. The previous two test were with the next version 97.0.4692.99. This is imminent for releasing as a routine update (needs just the advisory).

@Edward : when you get that, please re-try the problem.
Oh - and please post the output of:
 $ inxi -MSG
so we can see what your system is, desktop included.

CC: (none) => lewyssmith
Status: NEW => UNCONFIRMED
Ever confirmed: 1 => 0

Comment 5 Edward 2022-02-02 00:44:44 CET
~]$ inxi -MSG
System:
  Host: upstairs Kernel: 5.15.18-desktop-2.mga8 x86_64 bits: 64 
  Desktop: LXQt 0.16.1 Distro: Mageia 8 mga8 
Machine:
  Type: Desktop System: Hewlett-Packard product: CQ5826 v: N/A 
  serial: <superuser required> 
  Mobo: FOXCONN model: 2AB7 v: 1.00 serial: <superuser required> 
  BIOS: American Megatrends v: 6.09 date: 05/04/2011 
Graphics:
  Device-1: AMD RS780L [Radeon 3000] driver: radeon v: kernel 
  Display: x11 server: Mageia X.org 1.20.14 driver: ati,radeon,v4l 
  resolution: 1920x1080~60Hz 
  OpenGL: renderer: AMD RS780 (DRM 2.50.0 / 5.15.18-desktop-2.mga8 LLVM 11.0.1) 
  v: 3.3 Mesa 21.3.4
Comment 6 Edward 2022-02-02 00:46:43 CET
chrome://crashes is showing 50 separate crashes, however Chromium disabled crash reporting.
Comment 7 Dave Hodgins 2022-02-02 01:23:58 CET
crashes confirmed with ...
$ rpm -qa|grep chromium
chromium-browser-stable-97.0.4692.99-1.mga8
chromium-browser-97.0.4692.99-1.mga8
$ chromium-browser 
[48575:48575:0201/191702.329895:ERROR:vaapi_wrapper.cc(1119)] vaQuerySurfaceAttributes failed, VA error: invalid parameter
[48575:48575:0201/191702.389786:ERROR:vaapi_wrapper.cc(1066)] FillProfileInfo_Locked failed for va_profile VAProfileH264Main and entrypoint VAEntrypointVLD
[48575:48575:0201/191702.389867:ERROR:vaapi_wrapper.cc(1119)] vaQuerySurfaceAttributes failed, VA error: invalid parameter
[48575:48575:0201/191702.389909:ERROR:vaapi_wrapper.cc(1066)] FillProfileInfo_Locked failed for va_profile VAProfileH264High and entrypoint VAEntrypointVLD
[48540:48540:0201/191702.919943:ERROR:interface_endpoint_client.cc(658)] Message 0 rejected by interface blink.mojom.WidgetHost
[48540:48559:0201/191705.950868:ERROR:chrome_browser_main_extra_parts_metrics.cc(227)] START: ReportBluetoothAvailability(). If you don't see the END: message, this is crbug.com/1216328.
[48540:48559:0201/191705.950900:ERROR:chrome_browser_main_extra_parts_metrics.cc(230)] END: ReportBluetoothAvailability()
*** stack smashing detected ***: terminated
Received signal 6
#0 0x56196d755e09 base::debug::CollectStackTrace()
#1 0x56196d693f73 base::debug::StackTrace::StackTrace()
#2 0x56196d7558f1 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#3 0x7fee72e72180 (/usr/lib64/libpthread-2.32.so+0x1317f)
#4 0x7fee6fc31490 __GI_raise
#5 0x7fee6fc1c526 __GI_abort
#6 0x7fee6fc707a8 __libc_message
#7 0x7fee6fcfb172 __GI___fortify_fail
#8 0x7fee6fcfb150 __stack_chk_fail_local
#9 0x56196cfa7af5 content::RunZygote()
#10 0x56196cfa8862 content::ContentMainRunnerImpl::Run()
#11 0x56196cfa5f3c content::RunContentProcess()
#12 0x56196cfa685c content::ContentMain()
#13 0x5619685de9a8 ChromeMain
#14 0x7fee6fc1de1a __libc_start_main
#15 0x5619685de7aa _start
  r8: 0000000000000000  r9: 00007ffe7840e068 r10: 0000000000000008 r11: 0000000000000246
 r12: 00007ffe7840e2d0 r13: 0000000000001000 r14: 0000000000000020 r15: 00007fee72eac000
  di: 0000000000000002  si: 00007ffe7840e068  bp: 00007ffe7840e3d0  bx: 00007fee6d41ed40
  dx: 0000000000000000  ax: 0000000000000000  cx: 00007fee6fc31490  sp: 00007ffe7840e0e0
  ip: 00007fee6fc31490 efl: 0000000000000246 cgf: 002b000000000033 erf: 0000000000000000
 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]
Received signal 11 <unknown> 03e800000001
#0 0x56196d755e09 base::debug::CollectStackTrace()
#1 0x56196d693f73 base::debug::StackTrace::StackTrace()
#2 0x56196d7558f1 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#3 0x7fee72e72180 (/usr/lib64/libpthread-2.32.so+0x1317f)
#4 0x7fee6fc1c5e9 __GI_abort
#5 0x7fee6fc707a8 __libc_message
#6 0x7fee6fcfb172 __GI___fortify_fail
#7 0x7fee6fcfb150 __stack_chk_fail_local
#8 0x56196cfa7af5 content::RunZygote()
#9 0x56196cfa8862 content::ContentMainRunnerImpl::Run()
#10 0x56196cfa5f3c content::RunContentProcess()
#11 0x56196cfa685c content::ContentMain()
#12 0x5619685de9a8 ChromeMain
#13 0x7fee6fc1de1a __libc_start_main
#14 0x5619685de7aa _start
  r8: 0000000000000000  r9: 00007ffe7840e068 r10: 0000000000000008 r11: 0000000000000246
 r12: 00007ffe7840e2d0 r13: 0000000000001000 r14: 0000000000000020 r15: 00007fee72eac000
  di: 0000000000000002  si: 00007ffe7840e068  bp: 00007ffe7840e3d0  bx: 00007fee6d41ed40
  dx: 0000000000000000  ax: 0000000000000000  cx: 00007fee6fc31490  sp: 00007ffe7840e170
  ip: 00007fee6fc1c5e9 efl: 0000000000010246 cgf: 002b000000000033 erf: 0000000000000000
 trp: 000000000000000d msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]

CC: (none) => davidwhodgins
Status: UNCONFIRMED => NEW
Ever confirmed: 0 => 1

Comment 8 Dave Hodgins 2022-02-02 01:24:28 CET
Note I did not use incognito mode.
Comment 9 Dave Hodgins 2022-02-02 01:30:17 CET
Tried using incognito window. No problems with usage (original window doesn't
close) though konsole is showing same crashes as above.
Comment 10 Dave Hodgins 2022-02-02 01:32:34 CET
Ah. Using the X in the top right of the incognito window does close both
windows, however using the x on the last tab in the incognito window as I
normally do, does not close both.
Comment 11 David Walser 2022-02-02 19:00:26 CET
(In reply to Dave Hodgins from comment #10)
> Ah. Using the X in the top right of the incognito window does close both
> windows, however using the x on the last tab in the incognito window as I
> normally do, does not close both.

Not in 97.0.4692.99.  As for the crash messages in the console, I do see those in 97.0.4692.99, but it doesn't actually crash.
Comment 12 Edward 2022-02-02 19:03:49 CET
An individual on Mageia's Forum suggested I try the AppImage of Chromium. It downloaded version 100.0.4866.0 (Developer Build) and it did not crash. It retrieved all of the extensions installed, as well as the Bookmarks.

Clicking the X on the Incognito window (correctly) only closed the Incognito window and left the regular window open. This was with the hardware acceleration setting both on and off.
Comment 13 Edward 2022-02-02 19:04:33 CET
The link to the Forum thread above, also has the output from the terminal when the AppImage was run.
Comment 14 Morgan Leijström 2022-02-02 20:29:24 CET
Hi!  That was me; In the forum I am morgano :)
Comment 15 Lewis Smith 2022-02-02 21:46:58 CET
(In reply to Dave Hodgins from comment #7)
> crashes confirmed with ...
> $ rpm -qa|grep chromium
> chromium-browser-stable-97.0.4692.99-1.mga8
> chromium-browser-97.0.4692.99-1.mga8
> (In reply to Dave Hodgins from comment #8)
> Note I did not use incognito mode.
You did not say how you got the crashes. Remember that three of us have not seen them (at least, the browser did not crash whatever might have been O/P on the terminal). Please do clarify how you get crashes.

Thank you Edward for trying version 100.0.4866.0.
If you still have the original version chromium-browser-stable-96.0.4664.110-1, can you see whether Dave's discovery works for you: that closing the 'incognito' window by closing its last *tab* does not close the normal window.

With the evidence provided (or to come), assigning this to cjw whose baby chromium really is; also CC'ing ns80 who has done recent new versions for bugs.

Assignee: bugsquad => cjw
CC: lewyssmith => nicolas.salguero
Source RPM: chromium-browser-1:96.0.4664.110-1.mga8.x86_64 => chromium-browser-stable-96.0.4664.110-1.mga8.src.rpm

Comment 16 Edward 2022-02-02 21:57:35 CET
With only one tab in the Incognito window present, once closed it would correctly close the Incognito window while keeping the normal window open.

I then opened a new incognito window and opened eight tabs. Upon closing the last of the tabs, it closed both windows. Am able to repeat this.
Comment 17 Edward 2022-02-03 02:47:49 CET
Just received the new version of Chromium (97.0.4692.99 (Developer Build).

I had one crash when clicking the three-dot menu, not sure what occurred.

But with an Incognito window open with 30 tabs (no actual web pages loaded), upon closing the last tab, the window closed and correctly kept the normal window open. 

I also checked chrome://crashes and it shows four crashes with the exact same timestamp - down to the second, which apparently was while I was closing the 30 tabs. This, I was able to duplicate, an additional four crashes (with the same timestamp to the second) were listed while closing another 30 tabs in a new incognito window. In both of these instances Chromium as a whole did not crash, the normal window remained open.
Comment 18 Edward 2022-02-03 02:52:10 CET
And with the new version, closing the Incognito window by clicking the upper-right X, has so far, not caused Chromium to crash, but it apparently created another four new crash reports, all with the exact same timestamp.
Comment 19 Edward 2022-02-03 16:09:35 CET
In using the new version this morning, it has so far, not actually crashed (to the point where it quits), but discovered that in the first three minutes of simply using it, chrome://crashes displayed 28 new crash reports.
Comment 20 christian barranco 2022-03-16 19:59:40 CET
Hi Edward. Does it still crash with Chromium 99, just released in MGA8?

CC: (none) => chb0

Comment 21 Edward 2022-03-17 02:10:15 CET
(In reply to christian barranco from comment #20)
> Hi Edward. Does it still crash with Chromium 99, just released in MGA8?

Hi. Chromium 99 has not crashed. Also not seeing any new crash reports listed under the chrome://crashes URL.
Comment 22 Morgan Leijström 2022-03-17 09:37:49 CET
Good then.

Closing as fixed.

Please reopen if same problem appears again.

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.