Browser Crash Diagnosis

Independent crash diagnosis (2026-10-26; read-only source review)

The reproduced renderer failure is a native deliberate SIGTRAP, not a JavaScript exception. In renderer PID 1995856, the crashed Compositor thread stopped at Chromium offset 0x9aa4a27 immediately after int3, followed by ud2. The function saves its size argument to a stack local, calls an alias-style function, then traps. The saved size is 0x40000 (262144 bytes). This matches Chromium's documented OnNoMemoryInternal/TerminateBecauseOutOfMemory pattern; symbols for the exact Chromium build were unavailable, so function names are inferred from source and machine code rather than a symbolized backtrace.

The calling path at offset 0x2461883 passes its saved requested size to this trap after checking a newly created shared-memory region for an invalid descriptor. Its creation call reaches code at offset 0x9a7ad80 containing direct references to 'Create' and '../../base/memory/platform_shared_memory_region_posix.cc'. That creation path calls offset 0x9a5dcd0; its dynamic relocation confirms a call to fallocate64, with failure checked and errno handling. This materially narrows the mechanism to failed shared-memory-region creation, rather than generic application memory growth.

The browser launch uses --disable-dev-shm-usage and the core mappings include deleted /tmp/.org.chromium.Chromium.* files. Read-only quotactl_fd(Q_GETQUOTA, USRQUOTA, UID 1000) succeeded: hard/soft quota 13,111,334 KiB = 13,426,006,016 bytes. Before cleanup, usage was 13,243,674,624 bytes, leaving 182,331,392 bytes (~174 MiB), despite df reporting roughly 3.3 GiB free globally. Root separately observed a real EDQUOT while downloading the pinned browser into /tmp. After removal of only the disposable Wordpairs npm cache, independent usage was 12,982,566,912 bytes, leaving 443,439,104 bytes (~423 MiB). No quota or system configuration was changed. These observations strongly support quota exhaustion of Chromium's temporary shared-memory backing as the cause. The precise errno returned by the historical failed Chromium syscall was not captured, so that final causal link remains an inference, not an errno trace.

A controlled full-suite launch using /usr/lib/chromium/chromium instead of /usr/bin/chromium still produced a Target crashed failure in matches.phase4 and a separate content timeout: 24/26 passed. Therefore bypassing the system launcher did not resolve the failure; the Omarchy flags and browser-version mismatch are not proven causes. The content timeout has a separate test dependency race: senior navigation immediately followed the proposer appeal click, without waiting for the appeal response. Waiting for the authoritative 'appealed' status before senior navigation is the appropriate synchronization.

Required confirmation: unchanged full acceptance journeys must pass with clean browser exit after restoring adequate temporary-storage headroom, without retries or removed assertions. Preserve the earlier failures in the evidence history. If another native crash occurs, capture a narrowly scoped syscall trace of file allocation failure and quota sampling; do not infer resolution from an isolated passing test. This diagnosis does not provide human usability sign-off or Phase 6 exit approval.

Temporary core extraction used a fresh mktemp path and an EXIT trap, and was removed. No raw core is published. No implementation, user browser settings, mount/quota settings, unrelated temporary files, deployment, or refs were changed by this reviewer.

Primary source comparisons: https://chromium.googlesource.com/chromium/src/base/+/dfae0d5907632e6ae9ff5720f0700a51277f2fcd/allocator/partition_allocator/src/partition_alloc/oom.cc https://chromium.googlesource.com/chromium/src/+/b2075eb/base/memory/platform_shared_memory_region_posix.cc