Crash when dragging a tab group

[wknapik]

Brave Version: 1.50.119 Chromium: 112.0.5615.121 Operating System: Linux 6.1.21-hardened1-1-hardened

URL (if applicable) where crash occurred: n/a

Can you reproduce this crash? Yes

What steps will reproduce this crash? (If it's not reproducible, what were you doing just before the crash?)

1. Start the browser with a new profile
2. Add the new tab to a new group and name it
3. Open a new tab
4. Drag the tab group to the right

f1280000-a435-f609-0000-000000000000 292f0000-a435-f609-0000-000000000000

In my main profile this is 100% reproducible and the browser crashes entirely, but it seems in fresh profiles, across channels, this doesn't reproduce as easily and also the browser windows disappear, but some browser processes stick around, have to be killed manually.

https://bravesoftware.slack.com/archives/C01826CM3J9/p1681925022878289

DO NOT CHANGE BELOW THIS LINE Crash ID: crash/292f0000-a435-f609-0000-000000000000

[bsclifton]

Couldn't reproduce on Windows 11 (x64)- I tried Release (1.50.119) and Nightly (1.52.57)

@fallaciousreasoning can you try to reproduce this please?

Backtrace links:

• https://brave.sp.backtrace.io/p/brave/debug?fingerprint=418efed6a85e7b9984070b44cc9756821b460bb6bca37f820584f36a1a2492d0&debug=(%224a87efd%22,0,0)
• https://brave.sp.backtrace.io/p/brave/debug?filters=(_rxid%3D%22292f0000-a435-f609-0000-000000000000%22)&fingerprint=539302c1c1a2e975e9dd974a78026f7f342efaefcfb42ead6f4b4243ebf829bb&debug=(%224a88530%22,0,0)

[wknapik]

I have the following flags enabled in my main profile:

• brave://flags/#scrollable-tabstrip (enabled)
• brave://flags/#scrollable-tabstrip-overflow (enabled, tabs scrolling with constant speed)
• brave://flags/#scrollable-tabstrip-with-dragging (enabled)

[fallaciousreasoning]

I enabled those flags @wknapik and tested on 1.50.114 and couldn't reproduce. Weirdly, when I dragged the grouped tabs it ungrouped them (no crash though).

Without the flags it still ungroups on drag - maybe it's intentional?

[bsclifton]

@fallaciousreasoning can you try updating to 1.50.119? Maybe the latest Chromium bump introduced something? Thanks for checking BTW! 😄

[fallaciousreasoning]

Upgraded to 1.50.121 - still doesn't repro with or without the flags :/

[wknapik]

Upgraded to v1.50.125, still fully reproducible (af090700-f270-ff09-0000-000000000000, 760e0700-f270-ff09-0000-000000000000)

% brave
[1553546:1553546:0501/162742.954724:ERROR:chrome_browser_cloud_management_controller.cc(162)] Cloud management controller initialization aborted as CBCM is not enabled.
[0501/162752.609649:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[0501/162752.610114:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[1]    1553546 floating point exception (core dumped)  brave
%

Also still the same behavior in fresh profiles (windows disappear, but processes stick around)

[wknapik]

I'm using Arch Linux with a hardened kernel, if you'd like to try and reproduce this in a more similar environment

[wknapik]

Just tried dragging a tab between two windows in 1.51.118 and the whole browser crashed

[wknapik]

It looks like the custom flags are the cause, specifically #scrollable-tabstrip-overflow. Tested on 1.52.117, Linux.

Crashes:

• Custom flags, dragging private tabs between windows: fd560000-f897-2d0a-0000-000000000000
• Custom flags, dragging tab groups: c25d0000-f897-2d0a-0000-000000000000
• All 3 *just* enabled, dragging tab groups: d96b0000-f897-2d0a-0000-000000000000
• #scrollable-tabstrip enabled, #scrollable-tabstrip-overflow tabs scrolling with constant speed, #scrollable-tabstrip-with-dragging default, dragging tab groups: 82630000-f897-2d0a-0000-000000000000

No crashes:

• No custom flags, all set to default
• #scrollable-tabstrip enabled, others default
• #scrollable-tabstrip enabled, #scrollable-tabstrip-overflow default, #scrollable-tabstrip-with-dragging enabled

When flags are changed, a button to relaunch the browser shows up, but it just kills the browser, doesn't relaunch.

Each time the browser crashed, I started the browser, went to brave://crashes and had to click to upload the crash info. The page would then say "upload requested by user" and it would take exactly 15min before the actual upload would happen, every time.

Screenshot


[fallaciousreasoning]

Wow, good find!

[iefremov]

@wknapik i guess we really do not guarantee stable work with all combos of upstream flags