brave-browser Crash Report

IMPORTANT: Your crash has already been automatically reported to our crash system. Please file this bug only if you can provide more information about it.

Brave Version: 1.64.90 Chromium: 122.0.6261.94 Operating System: Windows NT 10.0.22631

URL (if applicable) where crash occurred:

Can you reproduce this crash? 100%

What steps will reproduce this crash? (If it's not reproducible, what were you doing just before the crash?) 1. 2. 3.

Brave crashes when I'm trying to sign-in into self-hosted Swizzin web app (https://github.com/swizzin/swizzin). When I type my login and password and click "Login", the tab crashes.

This behaviour started with one of the recent Brave updates (I'm not sure which one). I've just set up the app on a fresh test VPS just to confirm it's not a problem on my end. It works fine on e.g. Edge x64 122.0.2365.66 and Firefox x64 124.0b6.

I can provide an address of the web app with test login credentials, but I'm not sure how to do this more privately.

Zrzut ekranu 2024-03-04 164546

DO NOT CHANGE BELOW THIS LINE Crash ID: crash/6b6c1000-0f95-950b-0000-000000000000 Crash ID: crash/9f810800-3218-d60b-0000-000000000000 Crash ID: crash/a6810800-3218-d60b-0000-000000000000

Mar 04 '24 16:03 nastavoi

Backtrace link: https://brave.sp.backtrace.io/p/brave/debug?time=month&filters=JTVCJTVCJTIyX2RlbGV0ZWQlMjIlMkMlMjJlcXVhbCUyMiUyQyUyMjAlMjIlNUQlMkMlNUIlMjJfcnhpZCUyMiUyQyUyMmVxdWFsJTIyJTJDJTIyNmI2YzEwMDAtMGY5NS05NTBiLTAwMDAtMDAwMDAwMDAwMDAwJTIyJTVEJTVE&fingerprint=e53f1d2984c35ea7356ae35fbae265f842b80c86c928916d3b62000cdaeef39f&debug=(%226bb78d0%22,0,0)

[ 00 ] net::NetworkAnonymizationKey::~NetworkAnonymizationKey() ( network_anonymization_key.cc:78 )
[ 01 ] net::SpdySessionPool::MapKeyToAvailableSession(net::SpdySessionKey const &,base::WeakPtr<net::SpdySession> const &,std::__Cr::set<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::less<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > >,std::__Cr::allocator<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > > >) ( spdy_session_pool.cc:625 )
[ 02 ] net::SpdySessionPool::InsertSession(net::SpdySessionKey const &,std::__Cr::unique_ptr<net::SpdySession,std::__Cr::default_delete<net::SpdySession> >,net::NetLogWithSource const &,std::__Cr::set<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::less<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > >,std::__Cr::allocator<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > > >) ( spdy_session_pool.cc:727 )
[ 03 ] net::SpdySessionPool::CreateAvailableSessionFromSocketHandle(net::SpdySessionKey const &,std::__Cr::unique_ptr<net::ClientSocketHandle,std::__Cr::default_delete<net::ClientSocketHandle> >,net::NetLogWithSource const &,base::WeakPtr<net::SpdySession> *) ( spdy_session_pool.cc:163 )
[ 04 ] net::HttpStreamFactory::Job::DoCreateStream() ( http_stream_factory_job.cc:1212 )
[ 05 ] net::HttpStreamFactory::Job::DoLoop(int) ( http_stream_factory_job.cc:692 )
[ 06 ] net::HttpStreamFactory::Job::RunLoop(int) ( http_stream_factory_job.cc:587 )
[ 07 ] base::OnceCallback<void (int)>::Run(int) ( callback.h:156 )
[ 08 ] net::ClientSocketHandle::OnIOComplete(int) ( client_socket_handle.cc:171 )
[ 09 ] base::OnceCallback<void (int)>::Run(int) ( callback.h:156 )
[ 10 ] net::TransportClientSocketPool::InvokeUserCallback(base::raw_ptr<net::ClientSocketHandle,1>) ( transport_client_socket_pool.cc:1438 )
[ 11 ] base::OnceCallback<void ()>::Run() ( callback.h:156 )
[ 12 ] base::TaskAnnotator::RunTaskImpl(base::PendingTask &) ( task_annotator.cc:201 )
[ 13 ] base::TaskAnnotator::RunTask(perfetto::StaticString,base::PendingTask &,base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl::<lambda_4> &&) ( task_annotator.h:89 )
[ 14 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow *) ( thread_controller_with_message_pump_impl.cc:478 )
[ 15 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ( thread_controller_with_message_pump_impl.cc:343 )
[ 16 ] base::MessagePumpForIO::WaitForIOCompletion(unsigned long) ( message_pump_win.cc:766 )
[ 17 ] base::MessagePumpForIO::DoRunLoop() ( message_pump_win.cc:717 )
[ 18 ] base::MessagePumpWin::Run(base::MessagePump::Delegate *) ( message_pump_win.cc:79 )
[ 19 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool,base::TimeDelta) ( thread_controller_with_message_pump_impl.cc:649 )
[ 20 ] base::RunLoop::Run(base::Location const &) ( run_loop.cc:136 )
[ 21 ] base::Thread::Run(base::RunLoop *) ( thread.cc:337 )
[ 22 ] content::`anonymous namespace'::ChildIOThread::Run(base::RunLoop *) ( child_process.cc:59 )
[ 23 ] base::Thread::ThreadMain() ( thread.cc:412 )
[ 24 ] base::`anonymous namespace'::ThreadFunc(void *) ( platform_thread_win.cc:133 )
[ 25 ] 0x7ffcac82257d
[ 26 ] 0x7ffcadc4aa58
[ 27 ] 0x7ffcab42cd30

Mar 05 '24 23:03 bsclifton

Hi, just to add to this (not sure if it's useful or not) but I can reproduce on 1.63.161 and later builds on RHEL 9.

Seems that the bug was introduced between 1.62.165 and 1.63.161 - as in 1.62.165 was the last version of Brave that I could find where Swizzin logged in fine.

Apr 04 '24 09:04 heliconz

found any fix? this is exactly the same problem i have with swizzin

May 07 '24 06:05 johnay0

Still a problem in 1.66.102 Chromium 124.0.6367.118.

May 08 '24 15:05 nastavoi

does it work in chrome? the stack seems purely upstream. Also, do you observe who the whole Brave applciation crashes? From the dumps i see this is a crash in network process

May 14 '24 18:05 iefremov

additional backtrace link https://share.backtrace.io/api/share/TWRq0Sx2TGu2c2Bx2WvbyVd1

May 14 '24 18:05 iefremov

@iefremov

Works fine on Chrome 124.0.6367.208 x64, Edge 124.0.2478.97 x64 and Firefox 126.0 x64. In my case only the tab in which I try to open the portal hangs and then crashes.

May 14 '24 18:05 nastavoi

@nastavoi so this is a tab crash? Can you please repro and upload the most recent dump / share the id?

May 14 '24 18:05 iefremov

@iefremov Sorry if I wasn't clear enough before - yes, the tab is crashing.

Crash ID: crash/28dd1300-bb03-f30b-0000-000000000000 Crash ID: crash/2edd1300-bb03-f30b-0000-000000000000

May 14 '24 19:05 nastavoi

thanks @nastavoi . I assume you don't have anything toggled on brave://flags?

May 14 '24 19:05 iefremov

@iefremov Actually I have some flags toggled at the moment:

#brave-web-view-rounded-corners - disabled #brave-horizontal-tabs-update - disabled #fluent-scrollbars - enabled #enable-parallel-downloading - enabled #windows-scrolling-personality - enabled

But to be clear, I've tested it before on fresh Brave install and with new profile, same thing happened. I've also cleared the flags a minute ago and it's still crashing.

May 14 '24 19:05 nastavoi

gotcha

May 14 '24 19:05 iefremov

I experience the exact same issue on Brave specifically, works fine in Chrome, Edge, and Firefox...

May 25 '24 03:05 alramaz

The crash stack is:

[ 00 ] ImmediateCrash() ( immediate_crash.h:176 )
[ 01 ] CheckFailure() ( check.h:212 )
[ 02 ] net::SpdySessionPool::MapKeyToAvailableSession(net::SpdySessionKey const &,base::WeakPtr<net::SpdySession> const &,std::__Cr::set<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::less<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > >,std::__Cr::allocator<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > > >) ( spdy_session_pool.cc:626 )
[ 03 ] net::SpdySessionPool::InsertSession(net::SpdySessionKey const &,std::__Cr::unique_ptr<net::SpdySession,std::__Cr::default_delete<net::SpdySession> >,net::NetLogWithSource const &,std::__Cr::set<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >,std::__Cr::less<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > >,std::__Cr::allocator<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > > >) ( spdy_session_pool.cc:728 )
[ 04 ] net::SpdySessionPool::CreateAvailableSessionFromSocketHandle(net::SpdySessionKey const &,std::__Cr::unique_ptr<net::ClientSocketHandle,std::__Cr::default_delete<net::ClientSocketHandle> >,net::NetLogWithSource const &,base::WeakPtr<net::SpdySession> *) ( spdy_session_pool.cc:163 )
...

The main reason of the crash is incorrectly implemented operator < here (the issue)

It leads in an inconsistent state of available_sessions_ in SpdySessionPool and CHECK failure.

Jun 12 '24 19:06 atuchin-m

The above requires 1.67.116 or higher for 1.67.x verification 👍 @brave/qa-team can use the template from https://github.com/brave/brave-core/pull/24167#issuecomment-2167128866 for verification.

Jun 14 '24 03:06 kjozwiak

Verification PASSED on

Brave | 1.67.116 Chromium: 126.0.6478.71 (Official Build) (64-bit)
-- | --
Revision | f4237fe448716e50cca6e827ff87ffd701c7d0c7
OS | Windows 10 Version 22H2 (Build 19045.4529)

Using the STR/Cases outlined via https://github.com/brave/brave-core/pull/22053#issuecomment-1957706020 as per https://github.com/brave/brave-core/pull/24167#issue-2349511284, ensured that Tor was generally working as per the following:

ensured that opening a Tor window worked without any issues/failures
ensured that Tor connected without any issues/failures
visited https://check.torproject.org and ensured that a new IP is being assigned every time when Ctrl+Shift+R/Cmd+Shift+R
- ensured that a new IP is being assigned every time when via New Tor connection for this site