Brave crashes when downloading something with various extensions

[thericle]

Description

When I try to download something using an extension, the browser crashes and just closes. It's not the extensions' fault, because it's happening with lots of them. For example:
SingleFile
SaveAs - save image as PNG/JPG/WebP
Tab Session Manager
Media Harvest : twitter Media Downloader
Convert WebP to JPG

It started happening with version 1.70.111, still not fixed on current version.
There is a topic on Brave Community about this issue:
https://community.brave.com/t/save-image-as-png-extensions-cause-brave-to-crash/569782

Steps to reproduce

I'll use SingleFile for this example

1. Install SingleFile
2. Go to any webpage
3. Click on "Save page with SingleFile"

Actual result

Brave just crashes after a few seconds

Expected result

Brave should not crash

Reproduces how often

Easily reproduced

Brave version (brave://version info)

Brave: 1.70.117 Chromium: 129.0.6668.59 (Official Build) (64-bit)
Revision: 5d4da8332eb061f79bb47ec5b0bf595600fdcd55
OS: Windows 11 Version 23H2 (Build 22631.4169)

Channel information

• release (stable)
• beta
• nightly

Reproducibility

• with Brave Shields disabled
• with Brave Rewards disabled
• in the latest version of Chrome

Miscellaneous information

No response

[vsDizzy]

I can confirm Brave browser crashes with these two lines:

    const url = 'data:multipart/related;base64,aGVsbG8gd29ybGQ='
    chrome.downloads.download({ url });

[gnossosp]

Brave is up to date
Version 1.70.117 Chromium: 129.0.6668.59 (Official Build) (64-bit)
Windows 10 Pro
OS. build 19045.4895

Using extension Reddit Enhancement Suite
v5.24.7
Images have a Save As icon. Clicking icon saves image but crashes browser.
Fixed by going to
(brave://settings/downloads) and disabling:

• Ask where to save each file before downloading

• Show downloads when they're done

[iefremov]

https://share.backtrace.io/api/share/pOA4iwea7XBDw1ADT1S1P0

[ 00 ] base::raw_ptr<content::BrowserContext, (partition_alloc::internal::RawPtrTraits)0>::GetForExtraction() const ( raw_ptr.h:1016 )
[ 01 ] base::raw_ptr<content::BrowserContext, (partition_alloc::internal::RawPtrTraits)0>::operator content::BrowserContext*() const ( raw_ptr.h:708 )
[ 02 ] content::NavigationControllerImpl::GetBrowserContext() ( navigation_controller_impl.cc:822 )
[ 03 ] content::WebContentsImpl::GetBrowserContext() ( web_contents_impl.cc:1568 )
[ 04 ] brave::GetFileSelectTitle(content::WebContents*, url::Origin const&, brave::FileSelectTitleType) ( brave_file_select_utils.cc:56 )
[ 05 ] (anonymous namespace)::GetTitle(content::RenderFrameHost*, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>> const&) ( download_file_picker.cc:24 )
[ 06 ] DownloadFilePicker::DownloadFilePicker(download::DownloadItem*, base::FilePath const&, base::OnceCallback<void (DownloadConfirmationResult, ui::SelectedFileInfo const&)>) ( download_file_picker.cc:107 )
[ 07 ] non-virtual thunk to ChromeDownloadManagerDelegate::RequestConfirmation(download::DownloadItem*, base::FilePath const&, DownloadConfirmationReason, base::OnceCallback<void (DownloadConfirmationResult, ui::SelectedFileInfo const&)>) ( chrome_download_manager_delegate.cc:0 )
[ 08 ] DownloadTargetDeterminer::DoRequestConfirmation() ( download_target_determiner.cc:614 )
[ 09 ] DownloadTargetDeterminer::DoLoop() ( download_target_determiner.cc:188 )
[ 10 ] base::OnceCallback<void (download::PathValidationResult, base::FilePath const&)>::Run(download::PathValidationResult, base::FilePath const&) && ( callback.h:156 )
[ 11 ] download::(anonymous namespace)::RunGetReservedPathCallback(base::OnceCallback<void (download::PathValidationResult, base::FilePath const&)>, base::FilePath const*, download::PathValidationResult) ( download_path_reservation_tracker.cc:413 )
[ 12 ] base::OnceCallback<void (int)>::Run(int) && ( callback.h:156 )
[ 13 ] void base::internal::ReplyAdapter<int, int>(base::OnceCallback<void (int)>, std::__Cr::unique_ptr<int, std::__Cr::default_delete<int>>*) ( post_task_and_reply_with_result_internal.h:31 )
[ 14 ] base::OnceCallback<void ()>::Run() && ( callback.h:156 )
[ 15 ] extensions::(anonymous namespace)::ValidateCrxHelper::FinishOnUIThread() ( startup_helper.cc:134 )
[ 16 ] void base::internal::DecayedFunctorTraits<void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>::Invoke<void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>(void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&) ( bind_internal.h:671 )
[ 17 ] void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, void, 0ul>::MakeItSo<void (*)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>>(void (*&&)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>&&) ( bind_internal.h:930 )
[ 18 ] void base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunImpl<void (*)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>, 0ul>(void (*&&)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) ( bind_internal.h:1067 )
[ 19 ] base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunOnce(base::internal::BindStateBase*) ( bind_internal.h:980 )
[ 20 ] base::OnceCallback<void ()>::Run() && ( callback.h:156 )
[ 21 ] base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ( task_annotator.cc:203 )
[ 22 ] void base::TaskAnnotator::RunTask<base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_3>(perfetto::StaticString, base::PendingTask&, base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_3&&) ( task_annotator.h:90 )

[kjozwiak]

The above requires 1.70.119 or higher for 1.70.x verification 👍

[kjozwiak]

Verification PASSED on Win 11 x64 using the following build(s):

Brave | 1.70.119 Chromium: 129.0.6668.70 (Official Build) (64-bit)
-- | --
Revision | a15c836a4df987f118ece1645f54b081019049de
OS | Windows 11 Version 23H2 (Build 22631.4169)

Using the STR/Cases outlined via #41179 (comment), ensured that SingleFile was downloading the pages without any issues/crashes as per the following:

extensionSave.mp4