On Sun, 5 Jul 2026 23:02:32 +0800 "=?utf-8?B?cGxtYW5lbw==?="
<[email protected]> wrote:
Control: tags -1 patch
Hi,
I can reproduce this crash on Debian 13 / amd64 with chromium
150.0.7871.46-1~deb13u1. I believe the root cause is the recently added
Debian patch:
debian/patches/ungoogled/remove-navigation-source-param.patch
That patch removes the whole GOOGLE_SEARCH_SOURCE case from
TemplateURLRef::HandleReplacements() in:
components/search_engines/template_url.cc
However, Debian's built-in default Google search engine template still
contains the replacement token:
{google:searchSource}
Example string present in /usr/lib/chromium/chromium:
{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:language}{google:prefetchSource}{google:searchClient}{google:sourceId}{google:searchSource}{google:contextualSearchVersion}ie={inputEncoding}
So when TemplateURLRef::HandleReplacements() sees a GOOGLE_SEARCH_SOURCE
replacement, there is no case handler anymore and execution reaches the
switch default:
default:
NOTREACHED();
In this build, that becomes a hard trap (int3/ud2), matching the observed
SIGTRAP / "Trace/breakpoint trap" crash. This also matches the
coredump
reported earlier at module offset 0xcea7db7; disassembly around that offset
shows:
cc int3
0f 0b ud2
I also tested the following differential cases:
* Debian chromium 150.0.7871.46-1~deb13u1: crashes at startup.
* Debian chromium 147.0.7727.137-1~deb13u1 unpacked locally: starts fine.
* Google Chrome for Testing 150.0.7871.46 on the same host: starts fine.
* The same Debian chromium 150 binary with only one diagnostic rodata
replacement, changing the embedded template token from
{google:searchSource} to same-length {google:searchClient}: starts fine.
The last test is not proposed as a real fix, only as a confirmation that the
leftover {google:searchSource} template token is the crash trigger.
This appears to be a Debian packaging/cherry-pick issue. In upstream
ungoogled-chromium, remove-navigation-source-param.patch exists alongside:
replace-google-search-engine-with-nosearch.patch
That second patch replaces the built-in Google search engine definition and
therefore removes the default template containing {google:searchSource}. In
Debian, only remove-navigation-source-param.patch was cherry-picked, leaving
an unhandled template token behind.
Thanks for debugging this! Once I test & verify, I'm going to send your
patch upstream (to ungoogled-chromium) so it doesn't bite anyone else.
Please let me know what author name I should use for the git commit; and
if you'd prefer a different email, that too.
I didn't see this issue since I'm using DDG instead of Google.
