Vertical tabs crash Brave when using a black theme

[jpovixwm]

Brave Version: 1.59.117 Chromium: 118.0.5993.70
Operating System: Windows NT 10.0.19041

URL (if applicable) where crash occurred: N/A

Can you reproduce this crash?
Yes.

What steps will reproduce this crash? (If it's not reproducible, what were you doing just before the crash?)

1. Enable vertical tabs
2. Apply a black theme, for example this one

DO NOT CHANGE BELOW THIS LINE
Crash ID: crash/94570200-29ee-dc0a-0000-000000000000

[kjozwiak]

Reproduced as well when trying to find the cause due to various reports from the community as per https://community.brave.com/t/brave-crashes-immediately-upon-startup/509970/5 & https://community.brave.com/t/brave-crashes-immediately-on-opening/509982/3.

Brave | 1.59.117 Chromium: 118.0.5993.70 (Official Build) (64-bit)
-- | --
Revision | 766577bee8f040990afcb32677dcab38ffcf0f06
OS | Windows 11 Version 22H2 (Build 22621.2428)

Test Case #1 (Vertical Tabs enabled before applying theme)

• install 1.59.117 Chromium: 118.0.5993.70
• enable vertical tabs via brave://settings/appearance
• attempt installing https://chrome.google.com/webstore/detail/slinky-elegant/bmanlajnpdncmhfkiccmbgeocgbncfln
• you'll instantly crash as mentioned above
  • 06600200-29ee-dc0a-0000-000000000000 & 16650200-29ee-dc0a-0000-000000000000

BTW, this only happens when you have vertical tabs enabled. For example, here's another version of the STR/Cases:

Test Case #2 (Vertical Tabs enabled after applying theme)

• install 1.59.117 Chromium: 118.0.5993.70
• install https://chrome.google.com/webstore/detail/slinky-elegant/bmanlajnpdncmhfkiccmbgeocgbncfln
• once installed, the theme should be applied without any issues/failures/crashes
• go into brave://settings/appearance and enable Vertical Tabs
• you'll get an instant crash with the same reason mentioned below via the crash stack

Both 1.61.x (Nightly) & 1.60.x (BETA) are also affected. Tried the above STR/Cases and reproduced using:

Brave | 1.61.18 Chromium: 118.0.5993.70 (Official Build) nightly (64-bit)
-- | --
Revision | 793b98318699def7fade71560e9dd7a08015482f
OS | Windows 11 Version 22H2 (Build 22621.2428)

Brave | 1.60.88 Chromium: 118.0.5993.70 (Official Build) beta (64-bit)
-- | --
Revision | ff9150ac5dd9934a7f431ddf478ad3e45ae68546
OS | Windows 11 Version 22H2 (Build 22621.2428)

Crash Stack

[ 00 ] ImmediateCrash() ( immediate_crash.h:146 )
[ 01 ] CheckFailure() ( check.h:192 )
[ 02 ] views::View::ConvertPointToTarget(views::View const *,views::View const *,gfx::Point *) ( view.cc:1028 )
[ 03 ] TopContainerBackground::PaintThemeAlignedImage(gfx::Canvas *,views::View const *,BrowserView const *,gfx::ImageSkia *) ( top_container_background.cc:50 )
[ 04 ] NewTabButton::PaintFill(gfx::Canvas *) ( new_tab_button.cc:255 )
[ 05 ] BraveNewTabButton::OnPaintFill(gfx::Canvas *) ( brave_new_tab_button.cc:90 )
[ 06 ] `anonymous namespace'::VerticalTabNewTabButton::OnPaintFill(gfx::Canvas *) ( vertical_tab_strip_region_view.cc:369 )
[ 07 ] NewTabButton::PaintButtonContents(gfx::Canvas *) ( new_tab_button.cc:215 )
[ 08 ] views::Button::OnPaint(gfx::Canvas *) ( button.cc:557 )
[ 09 ] views::View::Paint(views::PaintInfo const &) ( view.cc:1273 )
[ 10 ] views::View::RecursivePaintHelper((views::PaintInfo const &),views::PaintInfo const &) ( view.cc:2849 )
[ 11 ] views::View::PaintChildren(views::PaintInfo const &) ( view.cc:2291 )
[ 12 ] views::View::Paint(views::PaintInfo const &) ( view.cc:1278 )
[ 13 ] views::View::RecursivePaintHelper((views::PaintInfo const &),views::PaintInfo const &) ( view.cc:2849 )
[ 14 ] views::View::PaintChildren(views::PaintInfo const &) ( view.cc:2291 )
[ 15 ] views::View::Paint(views::PaintInfo const &) ( view.cc:1278 )
[ 16 ] views::View::RecursivePaintHelper((views::PaintInfo const &),views::PaintInfo const &) ( view.cc:2849 )
[ 17 ] views::View::PaintChildren(views::PaintInfo const &) ( view.cc:2291 )
[ 18 ] views::View::Paint(views::PaintInfo const &) ( view.cc:1278 )
[ 19 ] views::View::PaintFromPaintRoot(ui::PaintContext const &) ( view.cc:2857 )
[ 20 ] ui::Layer::PaintContentsToDisplayList() ( layer.cc:1444 )
[ 21 ] cc::PictureLayer::Update() ( picture_layer.cc:162 )
[ 22 ] cc::LayerTreeHost::PaintContent(std::__Cr::vector<scoped_refptr<cc::Layer>,std::__Cr::allocator<scoped_refptr<cc::Layer> > > const &) ( layer_tree_host.cc:1654 )
[ 23 ] cc::LayerTreeHost::DoUpdateLayers() ( layer_tree_host.cc:974 )
[ 24 ] cc::LayerTreeHost::UpdateLayers() ( layer_tree_host.cc:829 )
[ 25 ] cc::SingleThreadProxy::DoPainting(viz::BeginFrameArgs const &) ( single_thread_proxy.cc:1121 )
[ 26 ] cc::SingleThreadProxy::BeginMainFrame(viz::BeginFrameArgs const &) ( single_thread_proxy.cc:1081 )
[ 27 ] base::OnceCallback<void ()>::Run() ( callback.h:152 )
[ 28 ] base::TaskAnnotator::RunTaskImpl(base::PendingTask &) ( task_annotator.cc:201 )
[ 29 ] base::TaskAnnotator::RunTask(perfetto::StaticString,base::PendingTask &,base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl::<lambda_0> &&) ( task_annotator.h:89 )
[ 30 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow *) ( thread_controller_with_message_pump_impl.cc:480 )
[ 31 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ( thread_controller_with_message_pump_impl.cc:345 )
[ 32 ] absl::optional<base::WatchHangsInScope>::emplace() ( optional.h:362 )
[ 33 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoIdleWork() ( thread_controller_with_message_pump_impl.cc:557 )
[ 34 ] base::MessagePumpForUI::DoRunLoop() ( message_pump_win.cc:212 )
[ 35 ] base::MessagePumpWin::Run(base::MessagePump::Delegate *) ( message_pump_win.cc:78 )
[ 36 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool,base::TimeDelta) ( thread_controller_with_message_pump_impl.cc:648 )
[ 37 ] base::RunLoop::Run(base::Location const &) ( run_loop.cc:136 )
[ 38 ] base::RunLoop::RunLoop(base::RunLoop::Type) ( run_loop.cc:92 )
[ 39 ] content::BrowserMainLoop::RunMainMessageLoop() ( browser_main_loop.cc:1073 )
[ 40 ] content::BrowserMainRunnerImpl::Run() ( browser_main_runner_impl.cc:159 )
[ 41 ] content::BrowserMain(content::MainFunctionParams) ( browser_main.cc:34 )
[ 42 ] RunBrowserProcessMain(content::MainFunctionParams,content::ContentMainDelegate *) ( content_main_runner_impl.cc:704 )
[ 43 ] content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams,bool) ( content_main_runner_impl.cc:1288 )
[ 44 ] std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> >::operator basic_string_view() ( string:1082 )
[ 45 ] content::ContentMainRunnerImpl::Run() ( content_main_runner_impl.cc:1138 )
[ 46 ] RunContentProcess(content::ContentMainParams,content::ContentMainRunner *) ( content_main.cc:326 )
[ 47 ] content::ContentMain(content::ContentMainParams) ( content_main.cc:343 )
[ 48 ] ChromeMain(HINSTANCE__ *,sandbox::SandboxInterfaceInfo *,__int64) ( chrome_main.cc:189 )
[ 49 ] MainDllLoader::Launch(HINSTANCE__ *,base::TimeTicks) ( main_dll_loader_win.cc:166 )
[ 50 ] wWinMain(HINSTANCE__ *,HINSTANCE__ *,wchar_t *,int) ( chrome_exe_main_win.cc:390 )
[ 51 ] invoke_main() ( exe_common.inl:118 )
[ 52 ] __scrt_common_main_seh() ( exe_common.inl:288 )
[ 53 ] 0x7ff9eb45257d
[ 54 ] 0x7ff9eb8aaa78
[ 55 ] 0x7ff9e91ac550

[LaurenWags]

Could not reproduce on macOS.

Tried both cases from #33598 (comment), no crash for either of them.

Brave | 1.59.117 Chromium: 118.0.5993.70 (Official Build) (x86_64)
-- | --
Revision | 766577bee8f040990afcb32677dcab38ffcf0f06
OS | macOS Version 13.6 (Build 22G120)

[kjozwiak]

Solution #1 (Easiest):

Launch brave using --disable-features=BraveVerticalTabs. For example, in my case on Win 11 x64:

• Within the C:\Program Files\BraveSoftware\Brave-Browser\Application directory, launch Brave using brave.exe --enable-logging=stderr --disable-features=BraveVerticalTabs

You'll be able to launch the profile and should be able to remove the theming extensions via brave://extensions if you want to keep using Vertical Tabs. Or you can just just --disable-features=BraveVerticalTabs for now until we have a fix.

Solution #2:

Fix the profile that's affected by the above by removing the theming extension that's causing the crash. This might be tricky if you have a lot of themes installed. I would recommend removing all theming related extensions using the following:

• go into C:\Users\kamil\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions
Quick Note: the paths might differ as each machine will have a different username
• go through each folder and take a look at the manifest.json which will have a description
  • Example "description": "Smart. Simple. Beautiful Theme." (look for clues re: what the extension is/does)
• remove any folder that might look like a theme extension
• once removed, you should be able to launch Brave (theme won't be applied anymore)

Here's an example when you have https://chrome.google.com/webstore/detail/slinky-elegant/bmanlajnpdncmhfkiccmbgeocgbncfln installed which also causes the crash:

• attempt to launch Brave but it keeps crashing on startup
• went into C:\Users\kamil\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions
• noticed a folder named C:\Users\kamil\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\bmanlajnpdncmhfkiccmbgeocgbncfln
  • opened manifest.json and noticed this was an theme extension by looking at the description
  • also notice the same ID of the folder and the link of the extension (bmanlajnpdncmhfkiccmbgeocgbncfln)
• removed bmanlajnpdncmhfkiccmbgeocgbncfln from C:\Users\kamil\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions

Once bmanlajnpdncmhfkiccmbgeocgbncfln was removed, was able to start Brave without any issues.

Solution #3:

There's also another solution via https://community.brave.com/t/brave-crashes-immediately-upon-startup/509970/25 re: disabling the Vertical Tabs feature via the Preference file. But I would only recommend this for more advanced users. The solution requires you to go into AppData\Local\BraveSoftware\Brave-Browser\User Data\Default and edit the Preference file. Basically change vertical_tabs_enabled from true to false.

[zenparsing]

When a theme is installed with a tab strip background, the new tab button will paint itself using that background (instead of the just a normal solid color). In order to paint the "right" part of the background, it will offset the background image so that it matches up with the rest of the browser. To do that, it has do some some calculations involving the position of the button within the browser frame. As part of that, there's a check to make sure that the new tab button is actually contained within the browser view. For vertical tabs, this is not the case.

[kjozwiak]

The above requires 1.59.119 or higher for 1.59.x verification 👍

[btlechowski]

Verified with

Brave	1.59.120 Chromium: 118.0.5993.88 (Official Build) (64-bit)
Revision	135f92a9af2134bc7d7aeba82f87ff5e68669410
OS	Linux

Verified test plan from #33598 (comment)

Test Case #1 (Vertical Tabs enabled before applying theme)

Verified no crash

Test Case #2 (Vertical Tabs enabled after applying theme)

Verified no crash

---

Verification PASSED on

Brave | 1.59.120 Chromium: 118.0.5993.88 (Official Build) (64-bit)
-- | --
Revision | 135f92a9af2134bc7d7aeba82f87ff5e68669410
OS | Windows 10 Version 22H2 (Build 19045.3570)

Verified test plan from #33598 (comment)

Clean profile

Test Case #1 (Vertical Tabs enabled before applying theme)

• Confirmed there is no crash when Vertical tabs enabled before applying theme
  

Test Case #2 (Vertical Tabs enabled after applying theme)

• Confirmed there is no crash when Vertical Tabs enabled after applying theme
  

Upgrade profile

• Installed 1.59.117, created sync chain, updated the global and local shiled settings, added bookmarks, imported bookmarks from other browsers, added few extensions and upgraded the profile to 1.59.120, after upgrade applied the theme https://chrome.google.com/webstore/detail/slinky-elegant/bmanlajnpdncmhfkiccmbgeocgbncfln and enabled vertical tabs via brave://settings and ensured brave didn't crash
• Installed 1.59.117, created sync chain, updated the global and local shiled settings, added bookmarks, imported bookmarks from other browsers, added few extensions and upgraded the profile to 1.59.120, after upgrade enabled the vertical tabs
  via brave://settings and then applied the theme https://chrome.google.com/webstore/detail/slinky-elegant/bmanlajnpdncmhfkiccmbgeocgbncfln and ensured brave didn't crash

---

Verification PASSED on

Brave | 1.59.120 Chromium: 118.0.5993.88 (Official Build) (64-bit)
-- | --
Revision | 135f92a9af2134bc7d7aeba82f87ff5e68669410
OS | Windows 11 Version 22H2 (Build 22621.2428)

Verified test plan from #33598 (comment)

Clean profile

Test Case #1 (Vertical Tabs enabled before applying theme)

• Confirmed there is no crash when Vertical tabs enabled before applying theme

Test Case #2 (Vertical Tabs enabled after applying theme)

• Confirmed there is no crash when Vertical Tabs enabled after applying theme