chrome: Crash when clicking on a link on reading list button

Download cef_binary_90.6.5+g7a604aa+chromium-90.0.4430.93_linux64 from CEF builds and run on Ubuntu 18.04.

cefsimple crashes every time when clicking on a link on reading list button.

This also occurs on master build.

log:

‌

$ ./cefsimple --enable-chrome-runtime
[15020:15020:0518/150946.914002:ERROR:sandbox_linux.cc(374)] InitializeSandbox() called with multiple threads in process gpu-process.
[14974:14974:0518/150953.882261:ERROR:browser_info_manager.cc(581)] Timeout of new browser info response for frame process id 11 and routing id 1
Received signal 11 SEGV_MAPERR 000000000018
#0 0x7fb1704555e9 base::debug::CollectStackTrace()
#1 0x7fb1703c0643 base::debug::StackTrace::StackTrace()
#2 0x7fb170455190 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#3 0x7fb169919980 (/lib/x86_64-linux-gnu/libpthread-2.27.so+0x1297f)
#4 0x7fb1704146e4 base::SupportsUserData::GetUserData()
#5 0x7fb1702c1a76 CefBrowserHostBase::GetBrowserForContents()
#6 0x7fb1702cdb32 ChromeBrowserHostImpl::GetBrowserForContents()
#7 0x7fb1702ccf28 ChromeBrowserDelegate::OpenURLFromTab()
#8 0x7fb17375dd6c Browser::OpenURLFromTab()
#9 0x7fb17384528d ReadLaterPageHandler::OpenSavedEntry()
#10 0x7fb16efd8743 read_later::mojom::PageHandlerStubDispatch::Accept()
#11 0x7fb1707f43a8 mojo::InterfaceEndpointClient::HandleValidatedMessage()
#12 0x7fb1707f63b9 mojo::MessageDispatcher::Accept()
#13 0x7fb1707f9d36 mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#14 0x7fb1707f94d9 mojo::internal::MultiplexRouter::Accept()
#15 0x7fb1707f63b9 mojo::MessageDispatcher::Accept()
#16 0x7fb1707f1be4 mojo::Connector::DispatchMessage()
#17 0x7fb1707f2307 mojo::Connector::ReadAllAvailableMessages()
#18 0x7fb17080a0be mojo::SimpleWatcher::OnHandleReady()
#19 0x7fb16eac3700 base::internal::Invoker<>::RunOnce()
#20 0x7fb170417732 base::TaskAnnotator::RunTask()
#21 0x7fb1704284de base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl()
#22 0x7fb1704281ba base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()
#23 0x7fb1703db7a7 base::(anonymous namespace)::WorkSourceDispatch()
#24 0x7fb1689d3537 g_main_context_dispatch
#25 0x7fb1689d3770 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.5600.4+0x4c76f)
#26 0x7fb1689d37fc g_main_context_iteration
#27 0x7fb1703db572 base::MessagePumpGlib::Run()
#28 0x7fb170428b27 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run()
#29 0x7fb1703fa45b base::RunLoop::Run()
#30 0x7fb1702f4a65 CefMainRunner::RunMessageLoop()
#31 0x5561cc60c381 main
#32 0x7fb16931fbf7 __libc_start_main
#33 0x5561cc609b0a _start
  r8: 0000000000000002  r9: 2f2f3a7370747468 r10: 676f6f672e777777 r11: 3f2f6d6f632e656c
 r12: aaaaaaaaaaaaaaaa r13: 00007fff9d1d9aa0 r14: 00007fff9d1d9aa0 r15: 0000000000000000
  di: 0000000000000008  si: 00007fb1760954c8  bp: 00007fff9d1d9090  bx: 0000000000000000
  dx: 00007fff9d1d9aa0  ax: 00007fb175a10a01  cx: 733d64725f737767  sp: 00007fff9d1d9090
  ip: 00007fb1704146e4 efl: 0000000000010202 cgf: 002b000000000033 erf: 0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000018
[end of stack trace]
Calling _exit(1). Core file will not be generated.

‌

With debug build, dcheck failed.

[21222:21222:0518/152959.134181:FATAL:browser_host_base.cc(98)] Check failed: contents.

‌

I added null checking to Browser::OpenURLFromTab to avoid this dcheck failure.

diff --git a/patch/patches/chrome_browser_browser.patch b/patch/patches/chrome_browser_browser.patch
index f765d7150..eec24ad39 100644
--- a/patch/patches/chrome_browser_browser.patch
+++ b/patch/patches/chrome_browser_browser.patch
@@ -92,7 +92,7 @@ index 37b121e2b667d..ae70272bf2764 100644
    }

 +#if BUILDFLAG(ENABLE_CEF)
-+  if (cef_browser_delegate_) {
++  if (cef_browser_delegate_ && source) {
 +    auto web_contents = cef_browser_delegate_->OpenURLFromTab(source, params);
 +    if (!web_contents)
 +      return nullptr;

‌

With this modification, links on reading list button works fine.

Comments (5)