Segmentation fault in case a website would open a file picker on the host

SRAZKVT commented

2022-11-23 19:03:14 -06:00

(Migrated from github.com)

Operating System Info

Other

Other OS

Void Linux

OBS Studio Version

28.1.2

OBS Studio Version (Other)

No response

OBS Studio Log URL

https://obsproject.com/logs/Xi6IH3xMndBH73pD

OBS Studio Crash Log URL

No response

Expected Behavior

In interaction mode with the browser, a filepicker would be opened when necessary, allowing to choose a file.

Current Behavior

OBS completely crashes, due to a segmentation fault.

Steps to Reproduce

Set as target any website that would open a filepicker.
Enter interact mode with the browser.
Do the action that would open the filepicker.
OBS should close instantly.

Anything else we should know?

Both me and a friend have tried reproducing this, both on the flatpak version, it crashes every time.

### Operating System Info Other ### Other OS Void Linux ### OBS Studio Version 28.1.2 ### OBS Studio Version (Other) _No response_ ### OBS Studio Log URL https://obsproject.com/logs/Xi6IH3xMndBH73pD ### OBS Studio Crash Log URL _No response_ ### Expected Behavior In interaction mode with the browser, a filepicker would be opened when necessary, allowing to choose a file. ### Current Behavior OBS completely crashes, due to a segmentation fault. ### Steps to Reproduce 1. Set as target any website that would open a filepicker. 2. Enter interact mode with the browser. 3. Do the action that would open the filepicker. 4. OBS should close instantly. ### Anything else we should know? Both me and a friend have tried reproducing this, both on the flatpak version, it crashes every time.

WizardCM commented

2022-11-24 01:01:40 -06:00

(Migrated from github.com)

I can confirm this occurs on the Flatpak on GNOME, including when building my own Flatpak using Builder. It does not occur on standard builds.

This occurs both in browser docks and browser sources. Note that while using the file picker in browser sources is not officially supported, crashing is never a solution.

Annoyingly, I'm unable to get debug symbols to load with my local OBS/CEF build, and the CEF debug.log terminates immediately, so it doesn't log whatever goes wrong within CEF in this situation. I will continue trying to track down this bug.

I can confirm this occurs on the Flatpak on GNOME, including when building my own Flatpak using Builder. It does not occur on standard builds. This occurs **both** in browser docks and browser sources. Note that while using the file picker in browser sources is not officially supported, crashing is never a solution. Annoyingly, I'm unable to get debug symbols to load with my local OBS/CEF build, and the CEF `debug.log` terminates immediately, so it doesn't log whatever goes wrong within CEF in this situation. I will continue trying to track down this bug.

WizardCM commented

2022-12-01 06:42:46 -06:00

(Migrated from github.com)

Right, I've finally managed to get the Flatpak to give me proper debugging information.

https://github.com/obsproject/cef/blob/5060-shared-textures/libcef/browser/file_dialog_manager.cc#L440-L447

Note: this crash is limited to Flatpak at this time.

If a file browser is opened via the Inspect dialog of a browser source, the crash occurs on line 443, where it attempts to fetch a window handle.

If a file browser is opened via a Browser Dock, the crash occurs deeper, within the function called in 446. The code that crashes seems to be in Chromium itself.

I expect the cause of both is the same, even though the stack traces are different. It's important to note that we build CEF with use_gtk=false, however as this crash does not occur the apt package & local builds, I don't expect it's the cause.

This likely leaves it to either be a missing runtime dependency, or more likely a Flatpak sandbox issue. Unfortunately, this means it's outside my skillset. I will do what digging I can, and discuss with people who know Flatpak and/or CEF more in-depth.

Right, I've finally managed to get the Flatpak to give me proper debugging information. https://github.com/obsproject/cef/blob/5060-shared-textures/libcef/browser/file_dialog_manager.cc#L440-L447 **Note:** this crash is limited to Flatpak at this time. If a file browser is opened via the Inspect dialog of a browser source, the crash occurs on line 443, where it attempts to fetch a window handle. If a file browser is opened via a Browser Dock, the crash occurs deeper, within the function called in 446. The code that crashes seems to be in Chromium itself. I expect the cause of both is the same, even though the stack traces are different. It's important to note that we build CEF with `use_gtk=false`, however as this crash does not occur the apt package & local builds, I don't expect it's the cause. This likely leaves it to either be a missing runtime dependency, or more likely a Flatpak sandbox issue. Unfortunately, this means it's outside my skillset. I will do what digging I can, and discuss with people who know Flatpak and/or CEF more in-depth.

Refragg commented

2023-01-06 10:18:06 -06:00

(Migrated from github.com)

Coming from https://github.com/obsproject/obs-studio/issues/8012, since the issues seem related, thought i'd also say that for me, the crash happens on both the PPA package, custom build from source and Flatpak so i don't think it's a Flatpak related issue

WizardCM commented

2023-01-06 16:50:58 -06:00

(Migrated from github.com)

@Refragg What desktop environment are you using?

Refragg commented

2023-01-07 03:44:57 -06:00

(Migrated from github.com)

I'm on Ubuntu MATE 22.10, a friend of mine also reproduced this issue on Linux Mint Cinnamon 21.1

WizardCM commented

2023-01-07 22:40:40 -06:00

(Migrated from github.com)

Hmm, that's helpful. As I'm on 22.04 LTS, I can't reproduce - even on MATE, but I'll try on 22.10.

ChristianMRichter commented

2023-05-02 09:18:27 -05:00

(Migrated from github.com)

The issue is reproducable in Ubuntu 22.04 LTS. (at least in Browser Dock)

👍 1

ChristianMRichter commented

2023-06-20 04:34:55 -05:00

(Migrated from github.com)

Does anyone else can confirm the issue or give me a hint for a workarround?

SRAZKVT commented

2023-06-20 04:50:42 -05:00

(Migrated from github.com)

I can confirm it still happens in latest flatpak release, and i unfortunately haven't found a workaround as of yet.

sankaest commented

2024-01-11 15:47:43 -06:00

(Migrated from github.com)

Is that issue still open? Or I miss something?
As my OBS (30.0.2) installed either via PPA or Flatpack on Ubuntu 22.04 crashes while trying open a file in browser (in Dock, like Lower Third plugin, or just in browser). Also tried older versions of OBS (like 29.1.2) and still the same result - OBS closes its self while trying to open file manager via < input type="file" >.

Is that issue still open? Or I miss something? As my OBS (30.0.2) installed either via PPA or Flatpack on Ubuntu 22.04 crashes while trying open a file in browser (in Dock, like Lower Third plugin, or just in browser). Also tried older versions of OBS (like 29.1.2) and still the same result - OBS closes its self while trying to open file manager via < input type="file" >.

SRAZKVT commented

2024-01-12 02:21:14 -06:00

(Migrated from github.com)

Yes this issue is still open, if it wasn't, it would've been marked as closed

ChristianMRichter commented

2024-01-18 04:20:07 -06:00

(Migrated from github.com)

Yes, the issue is still open. I would really appreciate if it could be fixed.

david672orford commented

2024-03-11 11:51:02 -05:00

(Migrated from github.com)

Got a backtrace on this, but I is missing a lot of symbols. I'm not sure how to get a better trace with the source file and line number.

Thread 74 "CrBrowserMain" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff43df9640 (LWP 1178)]
0x00007fff83710b41 in ?? () from /usr/local//lib/obs-plugins/libcef.so
(gdb) 
(gdb) 
(gdb) 
(gdb) bt
#0  0x00007fff83710b41 in  () at /usr/local//lib/obs-plugins/libcef.so
#1  0x000000000000000b in  ()
#2  0x00007ffee42f3d10 in  ()
#3  0x00007ffee4301920 in  ()
#4  0x00007ffeec016380 in  ()
#5  0x00007ffee4301950 in  ()
#6  0x00007ffff3ca5453 in __GI___libc_free (mem=) at ./malloc/malloc.c:3391
#7  0x00007ffee4237fc0 in  ()
#8  0x00007fff43df7690 in  ()
#9  0x00007fff81589357 in  () at /usr/local//lib/obs-plugins/libcef.so
#10 0x00007fff43df7af0 in  ()
#11 0x00007ffee4237fc0 in  ()
#12 0x0000000000000000 in  ()

Got a backtrace on this, but I is missing a lot of symbols. I'm not sure how to get a better trace with the source file and line number. <pre> Thread 74 "CrBrowserMain" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fff43df9640 (LWP 1178)] 0x00007fff83710b41 in ?? () from /usr/local//lib/obs-plugins/libcef.so (gdb) (gdb) (gdb) (gdb) bt #0 0x00007fff83710b41 in () at /usr/local//lib/obs-plugins/libcef.so #1 0x000000000000000b in () #2 0x00007ffee42f3d10 in () #3 0x00007ffee4301920 in () #4 0x00007ffeec016380 in () #5 0x00007ffee4301950 in () #6 0x00007ffff3ca5453 in __GI___libc_free (mem=<optimized out>) at ./malloc/malloc.c:3391 #7 0x00007ffee4237fc0 in () #8 0x00007fff43df7690 in () #9 0x00007fff81589357 in () at /usr/local//lib/obs-plugins/libcef.so #10 0x00007fff43df7af0 in () #11 0x00007ffee4237fc0 in () #12 0x0000000000000000 in () </pre>

Rows
Columns

Segmentation fault in case a website would open a file picker on the host #384

Operating System Info

Other OS

OBS Studio Version

OBS Studio Version (Other)

OBS Studio Log URL

OBS Studio Crash Log URL

Expected Behavior

Current Behavior

Steps to Reproduce

Anything else we should know?