Thanks for the report. I would request you to please provide us with crash id from chrome://crash ? Which will help us expedite the triaging process.

Thank you!

The crash happens before the UI is loaded so we aren't able to access chrome://crash

Hey, thanks for all of your packaging work! Can you post the /usr/lib64/chromium-browser/lib/libgpu.so corresponding to that gdb session?

Hello, please see attachments. This is for Fedora 23 x86_64.

Deleted: Chromium stack smashing - jorgeml.txt 3.2 KB

Chromium stack smashing - jorgeml.txt 3.2 KB View Download

Deleted: libgpu.so 1.3 MB

libgpu.so 1.3 MB Download

Hm, that libgpu didn't seem to match the stack trace, but I downloaded https://copr-be.cloud.fedoraproject.org/results/spot/chromium/fedora-23-x86_64/00182133-chromium/chromium-libs-50.0.2661.94-2.fc23.x86_64.rpm, and that one seemed to match.

Based on where this function is happening, this looks like an issue with RE2 versions. The crash is happening in this function:

https://code.google.com/p/chromium/codesearch#chromium/src/gpu/config/gpu_control_list.cc&l=99

What's happening is: That function thinks the RE2 class is has a certain size (something that's <= 216 bytes), and allocates that much space on the stack. It calls RE2's constructor from a library, and that thinks the RE2 class is >216 bytes large, and initializes it accordingly. As a result, the stack canary is getting clobbered.

From the http://copr-dist-git.fedorainfracloud.org/cgit/spot/chromium/re2.git/tree/re2.spec, it looks like re2 is built from a tarball at https://github.com/google/re2/archive/2016-04-01.tar.gz.

I'm not familiar with how unbundling works, but based on http://copr-dist-git.fedorainfracloud.org/cgit/spot/chromium/chromium.git/tree/chromium.spec?h=f23#n559, it looks like the third_party/re2 directory is preserved, so chromium is likely building against the headers in that directory.

Here is a diff from re2.h in the tarball to re2.h in chromium:
https://gist.github.com/anonymous/267f095daef2defb15129fa464885102

It looks like some fields were removed in chromium's re2.h, so chromium thinks RE2 is smaller than it actually is - this agrees with the above theory for what's going on.

Perhaps re2 needs to be removed from the unbundling exclusion list?

Er, or more accurately, some fields were added to re2.h outside of chromium.

I'm going to mark this as WontFix since it doesn't look like a bug that can be fixed in chromium, but happy to continue discussing solutions, etc. here.

That totally makes sense. Thanks for tracking down where I screwed up. :) I'll get new packages out today that don't have this issue.