Browser crash when logging into Brave Premium account on Linux

[wknapik]

Description

https://bravesoftware.slack.com/archives/CG7GV6M7Z/p1653851657184549

The browser crashes when logging into a Premium account. This happens across channels on Arch Linux.

Steps to Reproduce

1. Get a Premium login link
2. Click on the link
3. See the browser crash

Actual result:

Crash

Expected result:

No crash

Reproduces how often:

Easily reproduced

Brave version (brave://version info)

Brave	1.39.111 Chromium: 102.0.5005.61 (Official Build) (64-bit)
Revision	0e59bcc00cc4985ce39ad31c150065f159d95ad3-refs/branch-heads/5005@{#819}
OS	Linux

Version/Channel Information:

• Can you reproduce this issue with the current release? Yes
• Can you reproduce this issue with the beta channel? Yes
• Can you reproduce this issue with the nightly channel? Yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? ?
• Does the issue resolve itself when disabling Brave Rewards? ?
• Is the issue reproducible on the latest version of Chrome? ?

Miscellaneous Information:

stdout/stderr on:

• nightly 1.41.12:

% brave-nightly 
tracing_subscriber - init success
[0529/211030.158369:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[0529/211030.158953:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[0529/211030.180670:ERROR:directory_reader_posix.cc(42)] opendir $HOME/.config/BraveSoftware/Brave-Browser-Nightly/Crash Reports/attachments/fc37baa8-af02-4f96-b47a-c4b340fcf75c: No such file or directory (2)
[55570:55590:0529/211031.048492:ERROR:broker_posix.cc(40)] Recvmsg error: Connection reset by peer (104)
/opt/brave.com/brave-nightly/brave-browser: line 48: 55529 Illegal instruction     (core dumped) "$HERE/brave" "$@"
%

• beta 1.40.71:

% brave-beta
tracing_subscriber - init success
[0529/211545.814604:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[0529/211545.815292:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[0529/211545.840503:ERROR:directory_reader_posix.cc(42)] opendir $HOME/.config/BraveSoftware/Brave-Browser-Beta/Crash Reports/attachments/a084496b-97cd-4f50-ade0-5ec79ab2a631: No such file or directory (2)
[60809:60838:0529/211546.822304:ERROR:broker_posix.cc(40)] Recvmsg error: Connection reset by peer (104)
/opt/brave.com/brave-beta/brave-browser: line 48: 60769 Illegal instruction     (core dumped) "$HERE/brave" "$@"
%

• release 1.39.111:

% brave --user-data-dir="$(mktemp -d)"
tracing_subscriber - init success
[0529/211811.600541:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[0529/211811.601105:ERROR:elf_dynamic_array_reader.h(64)] tag not found
[1]    63570 illegal hardware instruction (core dumped)  brave --user-data-dir="$(mktemp -d)"
%

I can share coredumps, please ask @wknapik on Slack.

[wknapik]

Retested on latest nightly, same behavior.

[fmarier]

I can repro on Debian (release channel).

[AlanBreck]

This may be next to impossible, but are you able to capture console logs immediately prior to the browser crashing?

[iefremov]

@wknapik @fmarier any ids on brave://crashes please ?

[iefremov]

[ 00 ] skus::SkusUrlLoaderImpl::OnFetchComplete(rust::cxxbridge1::Fn<void (rust::cxxbridge1::Box<skus::HttpRoundtripContext>, skus::HttpResponse)>, rust::cxxbridge1::Box<skus::HttpRoundtripContext>, std::__1::unique_ptr<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::default_delete<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > >) ( cxx.h:485 )
[ 01 ] base::internal::Invoker<base::internal::BindState<void (skus::SkusUrlLoaderImpl::*)(rust::cxxbridge1::Fn<void (rust::cxxbridge1::Box<skus::HttpRoundtripContext>, skus::HttpResponse)>, rust::cxxbridge1::Box<skus::HttpRoundtripContext>, std::__1::unique_ptr<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::default_delete<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > >), base::internal::UnretainedWrapper<skus::SkusUrlLoaderImpl>, rust::cxxbridge1::Fn<void (rust::cxxbridge1::Box<skus::HttpRoundtripContext>, skus::HttpResponse)>, rust::cxxbridge1::Box<skus::HttpRoundtripContext> >, void (std::__1::unique_ptr<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::default_delete<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > >)>::RunOnce(base::internal::BindStateBase*, std::__1::unique_ptr<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::default_delete<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > >&&) ( bind_internal.h:542 )
[ 02 ] network::(anonymous namespace)::SaveToStringBodyHandler::NotifyConsumerOfCompletion(bool) ( callback.h:143 )
[ 03 ] network::(anonymous namespace)::SimpleURLLoaderImpl::FinishWithResult(int) ( simple_url_loader.cc:1543 )
[ 04 ] network::(anonymous namespace)::SimpleURLLoaderImpl::OnComplete(network::URLLoaderCompletionStatus const&) ( simple_url_loader.cc:1761 )
[ 05 ] network::mojom::URLLoaderClientStubDispatch::Accept(network::mojom::URLLoaderClient*, mojo::Message*) ( url_loader.mojom.cc:1318 )

https://brave.sp.backtrace.io/p/brave/debug?filters=(_rxid%3D%2219bc0300-2578-4408-0000-000000000000%22%2Cver%3E%3D%2292%22%2Cptype%3Dbrowser)&debug=(%223485940%22,0,0)
@bsclifton can take a look please?

[wknapik]

@iefremov I wanted to retest, to share crash IDs, but now I can't get a login link (Linux, across channels).

Clicking "get login link" causes the button to change to "loading" and then nothing. I see xhr requests to https://subscriptions.bsg.brave.com/v1/auth are failing.

[bsclifton]

Should be fixed with brave/brave-core#13555 - we'll want to test after we get a new Nightly (version needs to be greater than 1.41.36)

[bsclifton]

Re-opening as this did not fix the issue for @fmarier; new crash log up here:
https://brave.sp.backtrace.io/p/brave/debug?filters=(_rxid%3D%226d070900-2578-4408-0000-000000000000%22)&fingerprint=ef7f2087acc06ee746d7e82c9d681fbc1669d66d409d7863923cdf2f05290e53&debug=(%2234d5719%22,0,0)

[bsclifton]

@rillian reports:

FWIW, my local build doesn't crash, but the page appears to hang on the loading spinner. console says, Uncaught (in promise) Error parsing JSON response

Will check out the V8 wrapper code in case it's not handling a response properly. There are some parts of the code doing JSON parsing.

[wknapik]

This is fixed for me in nightly 1.41.57, but still happening on beta 1.40.94 and release 1.39.122.

[kjozwiak]

This is fixed for me in nightly 1.41.57, but still happening on beta 1.40.94 and release 1.39.122.

@wknapik should be fixed in the next 1.40.x now that brave/brave-core#13706 has been merged.

This will go out in the next 1.39.x release if we need to either push a HF (hotfix) or we get a minor C102 chromium bump. If we don't end up releasing another 1.39.x, we'll close off the 1.39.x - Release #5 milestone and move this issue into the 1.40.x milestone.

[wknapik]

Thanks @kjozwiak!

[wknapik]

Fixed on nightly and beta. Only release left.

[kjozwiak]

Fixed on nightly and beta. Only release left.

We'll most likely get this out via 1.40.x unless we have another C102 minor chromium bump that includes desktop at which point this one will get picked up 👍

[kjozwiak]

Verification PASSED on PopOS 22.04 x64 using the following build(s):

Brave | 1.40.105 Chromium: 103.0.5060.53 (Official Build) (64-bit)
--- | ---
Revision | a1711811edd74ff1cf2150f36ffa3b0dae40b17f-refs/branch-heads/5060@{#853}
OS | Linux

Verified using the STR/Cases outlined via #23140 (comment) & brave/brave-core#13702 (comment).

Example: