Control: tags -1 patch
Hi,
I can reproduce this crash on Debian 13 / amd64 with chromium
150.0.7871.46-1~deb13u1. I believe the root cause is the recently added
Debian patch:
debian/patches/ungoogled/remove-navigation-source-param.patch
That patch removes the whole GOOGLE_SEARCH_SOURCE case from
TemplateURLRef::HandleReplacements() in:
components/search_engines/template_url.cc
However, Debian's built-in default Google search engine template still
contains the replacement token:
{google:searchSource}
Example string present in /usr/lib/chromium/chromium:
{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:language}{google:prefetchSource}{google:searchClient}{google:sourceId}{google:searchSource}{google:contextualSearchVersion}ie={inputEncoding}
So when TemplateURLRef::HandleReplacements() sees a GOOGLE_SEARCH_SOURCE
replacement, there is no case handler anymore and execution reaches the
switch default:
default:
NOTREACHED();
In this build, that becomes a hard trap (int3/ud2), matching the observed
SIGTRAP / "Trace/breakpoint trap" crash. This also matches the
coredump
reported earlier at module offset 0xcea7db7; disassembly around that offset
shows:
cc int3
0f 0b ud2
I also tested the following differential cases:
* Debian chromium 150.0.7871.46-1~deb13u1: crashes at startup.
* Debian chromium 147.0.7727.137-1~deb13u1 unpacked locally: starts fine.
* Google Chrome for Testing 150.0.7871.46 on the same host: starts fine.
* The same Debian chromium 150 binary with only one diagnostic rodata
replacement, changing the embedded template token from
{google:searchSource} to same-length {google:searchClient}: starts fine.
The last test is not proposed as a real fix, only as a confirmation that the
leftover {google:searchSource} template token is the crash trigger.
This appears to be a Debian packaging/cherry-pick issue. In upstream
ungoogled-chromium, remove-navigation-source-param.patch exists alongside:
replace-google-search-engine-with-nosearch.patch
That second patch replaces the built-in Google search engine definition and
therefore removes the default template containing {google:searchSource}. In
Debian, only remove-navigation-source-param.patch was cherry-picked, leaving
an unhandled template token behind.
A minimal safe fix would be to keep a no-op handler instead of deleting the
case entirely, for example:
case GOOGLE_SEARCH_SOURCE:
DCHECK(!replacement.is_post_param);
break;
This removes the generated source=chrome.ob/source=chrome.rb parameter while
still consuming the template replacement and avoiding NOTREACHED().
Alternatively, all built-in search templates containing {google:searchSource}
would need to be adjusted, but keeping the no-op case is the smaller and safer
Debian-side fix.
Suggested patch to Debian's ungoogled/remove-navigation-source-param.patch:
--- a/debian/patches/ungoogled/remove-navigation-source-param.patch
+++ b/debian/patches/ungoogled/remove-navigation-source-param.patch
@@ -1,9 +1,9 @@
# This removes a tracking parameter that is injected into the URL
# when navigating from the onmibox/realbox
--- a/components/search_engines/template_url.cc
+++ b/components/search_engines/template_url.cc
-@@ -1413,26 +1413,6 @@ std::string TemplateURLRef::HandleReplac
+@@ -1413,26 +1413,10 @@ std::string TemplateURLRef::HandleReplac
// url.insert(replacement.index, used_www ? "gcx=w&" :
"gcx=c&");
break;
- case GOOGLE_SEARCH_SOURCE: {
- DCHECK(!replacement.is_post_param);
- using OEP = ::metrics::OmniboxEventProto;
- std::string source_param;
- const auto pc = search_terms_args.page_classification;
- if (pc == OEP::NTP ||
- pc == OEP::INSTANT_NTP_WITH_OMNIBOX_AS_STARTING_FOCUS ||
- pc == OEP::SEARCH_RESULT_PAGE_NO_SEARCH_TERM_REPLACEMENT ||
- pc == OEP::SEARCH_RESULT_PAGE_DOING_SEARCH_TERM_REPLACEMENT ||
- pc == OEP::SEARCH_RESULT_PAGE_ON_CCT ||
- pc == OEP::SRP_ZPS_PREFETCH || pc == OEP::OTHER) {
- source_param = "chrome.ob";
- } else if (pc == OEP::NTP_REALBOX) {
- source_param = "chrome.rb";
- }
- if (!source_param.empty()) {
- HandleReplacement("source", source_param, replacement,
&url);
- }
- break;
- }
++ case GOOGLE_SEARCH_SOURCE:
++ DCHECK(!replacement.is_post_param);
++ break;
case GOOGLE_SEARCH_SOURCE_ID: {
DCHECK(!replacement.is_post_param);
Thanks.
此邮件由[email protected]通过Agent Mail自动发送。举报退订
