Bug#1041695: chromium: Crash when starting with --incognito option

[Maxime Silvier]

Package: chromium
Version: 115.0.5790.98-1~deb12u1
Severity: normal
X-Debbugs-Cc: maxim...@simplelogin.fr, te...@security.debian.org

Dear Maintainer,

Since last Bookworm stable update (deb12u1), Chromium crash after few seconds when starting with --incognito option (in order to navigate in private mode).
By comparrison, private mode still properly functions when using only the in-app option.

Previously, in version 113.0.5672.126-1, the option worked as intented: `chromium --incognito` command launches the program in private mode without any crash.

I tried to purge Chromium packages and user's config files, then reinstall, but it did not change anything to this issue. Same result when deactivating browser extensions (Ublock and Privacy Badger).

PS : Please forgive any spelling mistakes, as English is not my native language.

Best regards.


-- System Information:
Debian Release: 12.0
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.1.0-10-amd64 (SMP w/6 CPU threads; PREEMPT)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages chromium depends on:
ii chromium-common 115.0.5790.98-1~deb12u1
ii libasound2 1.2.8-1+b1
ii libatk-bridge2.0-0 2.46.0-5
ii libatk1.0-0 2.46.0-5
ii libatomic1 12.2.0-14
ii libatspi2.0-0 2.46.0-5
ii libbrotli1 1.0.9-2+b6
ii libc6 2.36-9
ii libcairo2 1.16.0-7
ii libcups2 2.4.2-3
ii libdbus-1-3 1.14.6-1
ii libdouble-conversion3 3.2.1-1
ii libdrm2 2.4.114-1+b1
ii libevent-2.1-7 2.1.12-stable-8
ii libexpat1 2.5.0-1
ii libflac12 1.4.2+ds-2
ii libfontconfig1 2.14.1-4
ii libfreetype6 2.12.1+dfsg-5
ii libgbm1 22.3.6-1+deb12u1
ii libgcc-s1 12.2.0-14
ii libglib2.0-0 2.74.6-2
ii libgtk-3-0 3.24.37-2
ii libjpeg62-turbo 1:2.1.5-2
ii libjsoncpp25 1.9.5-4
ii liblcms2-2 2.14-2
ii libminizip1 1.1-8+b1
ii libnspr4 2:4.35-1
ii libnss3 2:3.87.1-1
ii libopenh264-7 2.3.1+dfsg-3
ii libopenjp2-7 2.5.0-2
ii libopus0 1.3.1-3
ii libpango-1.0-0 1.50.12+ds-1
ii libpng16-16 1.6.39-2
ii libpulse0 16.1+dfsg1-2+b1
ii libre2-9 20220601+dfsg-1+b1
ii libsnappy1v5 1.1.9-3
ii libstdc++6 12.2.0-14
ii libwebp7 1.2.4-0.2
ii libwebpdemux2 1.2.4-0.2
ii libwebpmux3 1.2.4-0.2
ii libwoff1 1.0.2-2
ii libx11-6 2:1.8.4-2+deb12u1
ii libxcb1 1.15-1
ii libxcomposite1 1:0.4.5-1
ii libxdamage1 1:1.1.6-1
ii libxext6 2:1.3.4-1+b1
ii libxfixes3 1:6.0.0-2
ii libxkbcommon0 1.5.0-1
ii libxml2 2.9.14+dfsg-1.2
ii libxnvctrl0 525.85.05-1
ii libxrandr2 2:1.5.2-2+b1
ii libxslt1.1 1.1.35-1
ii xdg-desktop-portal-gtk [xdg-desktop-portal-backend 1.14.1-1
]
ii xdg-desktop-portal-kde [xdg-desktop-portal-backend 5.27.5-2
]
ii zlib1g 1:1.2.13.dfsg-1

Versions of packages chromium recommends:
ii chromium-sandbox 115.0.5790.98-1~deb12u1

Versions of packages chromium suggests:
pn chromium-driver <none>
ii chromium-l10n 115.0.5790.98-1~deb12u1
pn chromium-shell <none>

Versions of packages chromium-common depends on:
ii libc6 2.36-9
ii libjsoncpp25 1.9.5-4
ii libstdc++6 12.2.0-14
ii libx11-6 2:1.8.4-2+deb12u1
ii libxnvctrl0 525.85.05-1
ii x11-utils 7.7+5
ii xdg-utils 1.1.3-4.1
ii zlib1g 1:1.2.13.dfsg-1

Versions of packages chromium-common recommends:
ii chromium-sandbox 115.0.5790.98-1~deb12u1
ii fonts-liberation 1:1.07.4-11
ii libgl1-mesa-dri 22.3.6-1+deb12u1
ii libu2f-udev 1.1.10-3
ii plasma-workspace [notification-daemon] 4:5.27.5-2
ii system-config-printer 1.5.18-1
ii upower 0.99.20-2

Versions of packages chromium-sandbox depends on:
ii libc6 2.36-9

-- no debconf information

[Andres Salomon]

Are you running this in an X11 or Wayland session, and with which window manager or desktop environment? Do you have chromium configured to use X11 or Wayland?

[maxim...@simplelogin.fr]

I am running Chromium in a Plasma (X11) environment.

Version=======
KWin version: 5.27.5
Qt Version: 5.15.8
Qt compile version: 5.15.8
XCB compile version: 1.15

Operation Mode: X11 only

[Maxime Silvier]

My issue is still present when updating to 115.0.5790.170-1~deb12u1 (bookworm security). Retrograding to 114.0.5735.198-1~deb12u1 (bookworm main) fix it.

Starting Chromium 115 from terminal, the result is:
~$ chromium --incognito
Gtk-Message: 16:30:35.686: Failed to load module "appmenu-gtk-module"
[2786:2786:0805/163035.703777:ERROR:chrome_browser_cloud_management_controller.cc(162)] Cloud management controller initialization aborted as CBCM is not enabled.
[0805/163035.835279:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[0805/163035.835367:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[0805/163035.835395:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[2834:2852:0805/163036.323285:ERROR:ssl_client_socket_impl.cc(980)] handshake failed; returned -1, SSL error code 1, net_error -3
29119881505024:error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED:../../third_party/boringssl/src/ssl/handshake.cc:393:
Erreur de segmentation (core dumped)

Then the app crashes, compared to Chromium 114, where it does launch:
~$ chromium --incognito
Gtk-Message: 17:04:31.298: Failed to load module "appmenu-gtk-module"
[9165:9165:0805/170431.316306:ERROR:chrome_browser_cloud_management_controller.cc(162)] Cloud management controller initialization aborted as CBCM is not enabled.

[Andres Salomon]

On Sat, Aug 5 2023 at 03:14:08 PM +00:00:00, Maxime Silvier <maxim...@simplelogin.fr> wrote:

My issue is still present when updating to 115.0.5790.170-1~deb12u1 (bookworm security). Retrograding to 114.0.5735.198-1~deb12u1 (bookworm main) fix it. Starting Chromium 115 from terminal, the result is: ~$ chromium --incognito Gtk-Message: 16:30:35.686: Failed to load module "appmenu-gtk-module" [2786:2786:0805/163035.703777:ERROR:chrome_browser_cloud_management_controller.cc(162)] Cloud management controller initialization aborted as CBCM is not enabled. [0805/163035.835279:ERROR:elf_dynamic_array_reader.h(64)] tag not found [0805/163035.835367:ERROR:elf_dynamic_array_reader.h(64)] tag not found [0805/163035.835395:ERROR:elf_dynamic_array_reader.h(64)] tag not found [2834:2852:0805/163036.323285:ERROR:ssl_client_socket_impl.cc(980)] handshake failed; returned -1, SSL error code 1, net_error -3 29119881505024:error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED:../../third_party/boringssl/src/ssl/handshake.cc:393: Erreur de segmentation (core dumped)

Alright, thanks for trying. Looks like a bug in BoringSSL. There were a bunch of changes (4b6d950d8..dd5219451 in git) between 114 and 115. It also looks like you've got some kind of corrupt certificate. I know you said you tried getting rid of your configs, but also try running `chromium --temp-profile --incognito` . It could also be something in your ~/.pki directory, so you could try deleting or moving that out of the way as well.

[Maxime Silvier]

By running `chromium --temp-profile --incognito` there is no more "handshake" errors, yet I still have "tag not found" and "segmentation fault". At the end, Chromium fails to start:

~$ chromium --temp-profile --incognito
Using temporary profile: /tmp/tmp.MieOJUxAZj
Gtk-Message: 10:39:17.609: Failed to load module "appmenu-gtk-module"
[5186:5186:0806/103917.655122:ERROR:chrome_browser_cloud_management_controller.cc(162)] Cloud management controller initialization aborted as CBCM is not enabled.
[0806/103917.886103:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[0806/103917.886197:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[0806/103917.886226:ERROR:elf_dynamic_array_reader.h(64)] tag not found
Segmentation fault (core dumped)

Removing ~/.pki do not change anything either; Chromium crashes identically. I can replicate the issue with my two devices on Debian 12 : laptop and main computer—though they share a very similar configuration.

Thank you very much for your time and attention. I hope that more skilled users will encounter the problem and give you more information.

------- Original Message -------

[Maxime Silvier]

I have taken a closer look at the issue with `chromium -g` command — by the way, it is still present in chromium=116.0.5845.96-1~deb12u1 but this log was from the 115.0.X version.
I hope I did not omit anything useful (the original log file had more than 600 lines).

Best regards.

- - -

# Env:
# LD_LIBRARY_PATH=
# PATH=/home/maxim/.local/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
# GTK_PATH=
# CHROMIUM_FLAGS= --show-component-extension-options --enable-gpu-rasterization --no-default-browser-check --disable-pings --media-router=0 --enable-remote-extensions --load-extension=/usr/share/chromium/extensions/keepassxc-browser,/usr/share/chromium/extensions/privacy-badger,/usr/share/chromium/extensions/ublock-origin
/usr/bin/gdb /usr/lib/chromium/chromium -x /tmp/chromiumargs.5Cvn6Q

Reading symbols from /usr/lib/chromium/chromium...
(No debugging symbols found in /usr/lib/chromium/chromium)
[?2004h(gdb) [7mhandle SIG33 pass nostop noprint [27m
[C [C [C [C [C [Chandle SIG33 pass nostop noprint
[?2004l
Signal Stop Print Pass to program Description
SIG33 No No Yes Real-time event 33
[?2004h(gdb) [7mset pagination 0 [27m
[C [C [C [C [C [Cset pagination 0
[?2004l
[?2004h(gdb) run --ic [Kncognito
[?2004l
Starting program: /usr/lib/chromium/chromium --incognito
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[Detaching after fork from child process 4900]
[New Thread 0x7ffff19ff6c0 (LWP 4905)]
[Detaching after fork from child process 4906]
[Detaching after fork from child process 4907]
[Detaching after fork from child process 4908]
[New Thread 0x7ffff11fe6c0 (LWP 4911)]
[New Thread 0x7ffff01ff6c0 (LWP 4912)]
[New Thread 0x7fffef9fe6c0 (LWP 4913)]
[New Thread 0x7fffef1fd6c0 (LWP 4914)]
[New Thread 0x7fffee9fc6c0 (LWP 4915)]
[New Thread 0x7fffed9fa6c0 (LWP 4916)]
[New Thread 0x7fffee1fb6c0 (LWP 4917)]
[New Thread 0x7fffed1f96c0 (LWP 4918)]
[New Thread 0x7fffec9f86c0 (LWP 4919)]
[New Thread 0x7fffec1f76c0 (LWP 4920)]
[New Thread 0x7fffeafff6c0 (LWP 4921)]
[New Thread 0x7fffea7fe6c0 (LWP 4922)]
Gtk-Message: 11:50:40.232: Failed to load module "appmenu-gtk-module"
[New Thread 0x7fffe9ffd6c0 (LWP 4923)]
[Thread 0x7fffe9ffd6c0 (LWP 4923) exited]
[New Thread 0x7fffe9ffd6c0 (LWP 4924)]
[New Thread 0x7fffe97fc6c0 (LWP 4925)]
[New Thread 0x7fffe87fa6c0 (LWP 4927)]
[New Thread 0x7fffe8ffb6c0 (LWP 4926)]
[New Thread 0x7fffe7ff96c0 (LWP 4928)]
[New Thread 0x7fffe77f86c0 (LWP 4929)]
[New Thread 0x7fffe6fb76c0 (LWP 4930)]
[New Thread 0x7fffe67756c0 (LWP 4934)]
[Detaching after fork from child process 4935]
[4897:4897:0722/115040.316536:ERROR:chrome_browser_cloud_management_controller.cc(162)] Cloud management controller initialization aborted as CBCM is not enabled.
[New Thread 0x7fffe5e416c0 (LWP 4939)]
[New Thread 0x7fffe56406c0 (LWP 4944)]
[New Thread 0x7fffe4e3f6c0 (LWP 4945)]
[New Thread 0x7fffe45f26c0 (LWP 4960)]
[Detaching after fork from child process 4978]
[New Thread 0x7fffe3cf36c0 (LWP 4997)]

Thread 1 "chromium" received signal SIGSEGV, Segmentation fault.
0x00005555576f956b in ?? ()
[?2004h [?2004l
[?2004h(gdb) bak [Kcktrace
[?2004l
#0 0x00005555576f956b in ?? ()
#1 0x0000000000000000 in ?? ()
[?2004h(gdb) [7mthread apply all backtrace [27m
[C [C [C [C [C [Cthread apply all backtrace
[?2004l

[Andres Salomon]

Looks like you're missing function names from that backtrace - do you have chromium-dbgsym installed?

https://wiki.debian.org/AutomaticDebugPackages

If you're running debian stable, you'd want to add "deb http://deb.debian.org/debian-debug/ proposed-updates-debug main" to your /etc/apt/sources.list, and then run 'apt install chromium-dbgsym chromium-common-dbgsym'

And if you need to temporarily downgrade chromium because the version in proposed-updates-debug isn't new enough, you can do something like 'apt install chromium=115.0.5790.170-1~deb12u1 chromium-common=115.0.5790.170-1~deb12u1' to downgrade.

Once you have the debugging symbol packages installed, if you grab that backtrace again it should be useable.

[Maxime Silvier]

Yes, you are right; I installed chromium-common-dbgsym alone, without chromium-dbgsym… My bad. Here are the new log extract (one ?? () did remain, yet):

Thread 1 "chromium" received signal SIGSEGV, Segmentation fault.

0x00005555576fa56b in base::ObserverList<base::RunLoop::NestingObserver, false, true, base::internal::UncheckedObserverAdapter>::AddObserver(base::RunLoop::NestingObserver*) ()
[?2004h [?2004l
[?2004h(gdb) backtrace
[?2004l
#0 0x00005555576fa56b in base::ObserverList<base::RunLoop::NestingObserver, false, true, base::internal::UncheckedObserverAdapter>::AddObserver(base::RunLoop::NestingObserver*) ()
#1 0x0000555561094d3f in AvatarMenu::AvatarMenu(ProfileAttributesStorage*, AvatarMenuObserver*, Browser*) ()
#2 0x000055556109152c in DbusAppmenu::Initialize(base::OnceCallback<void (bool)>) ()
#3 0x000055556109410a in DbusAppmenuRegistrar::InitializeMenu(DbusAppmenu*) ()
#4 0x00005555610947c7 in DbusAppmenuRegistrar::OnNameOwnerChanged(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) ()
#5 0x0000555557e90d5f in base::internal::Invoker<base::internal::BindState<base::RepeatingCallback<void (std::map<base::FilePath, base::FilePath, std::less<base::FilePath>, std::allocator<std::pair<base::FilePath const, base::FilePath> > > const&)>, std::map<base::FilePath, base::FilePath, std::less<base::FilePath>, std::allocator<std::pair<base::FilePath const, base::FilePath> > > >, void ()>::RunOnce(base::internal::BindStateBase*) ()
#6 0x000055555b89e998 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ()
#7 0x000055555b8b83c3 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ()
#8 0x000055555b8b7e66 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ()
#9 0x000055555b8b88a5 in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ()
#10 0x000055555b91d70e in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) ()
#11 0x000055555b8b8c23 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ()
#12 0x000055555b87d74d in base::RunLoop::Run(base::Location const&) ()
#13 0x000055555987c997 in content::BrowserMainLoop::RunMainMessageLoop() ()
#14 0x000055555987e692 in content::BrowserMainRunnerImpl::Run() ()
#15 0x000055555987a1c4 in content::BrowserMain(content::MainFunctionParams) ()
#16 0x000055555ad4f2d2 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) ()
#17 0x000055555ad509c6 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) ()
#18 0x000055555ad50811 in content::ContentMainRunnerImpl::Run() ()
#19 0x000055555ad4dfa8 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ()
#20 0x000055555ad4e471 in content::ContentMain(content::ContentMainParams) ()
#21 0x000055555755b2f5 in ChromeMain ()
#22 0x00007ffff62461ca in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#23 0x00007ffff6246285 in __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6
#24 0x000055555755b021 in _start ()
[?2004h(gdb) thread apply all backtrace
[?2004l

------- Original Message -------

[Maxime Silvier]

Recent updates solved my issue. I can confirm that Chromium 119.0.6045.105-1~deb12u1 is no longer affected by a crash; the --incognito option works as intended. The last affected version that I did use was 117.0.5938.62-1~deb12u1. I did not test the 118 release.
In brief, the bug is resolved. Thank you for your patience and attention.
Bests regards.