8000 [Bug]: browser process crashes when BrowserView with invalidated web contents is used · Issue #36371 · electron/electron · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
[Bug]: browser process crashes when BrowserView with invalidated web contents is used #36371
8000
Closed
@CezaryKulakowski

Description

@CezaryKulakowski

Preflight Checklist

Electron Version

23.0.0-nightly.20221108

What operating system are you using?

Windows

Operating System Version

Windows 10

What arch are you using?

x64

Last Known Working Electron version

23.0.0-nightly.20221107

Expected Behavior

Steps to reproduce:
Start following app:

const { app, BrowserWindow, BrowserView } = require('electron')

function createWindow() {
  const win = new BrowserWindow({ width: 800, height: 600 });
  win.webContents.loadURL('https://www.electronjs.org');
  return win;
}

async function wait(ms) {
  return new Promise( (resolve) => {
    setTimeout( () => {
      resolve();
    }, ms);
  });
}

async function startTest() {
  const view = new BrowserView();
  view.setBounds({x: 0, y: 0, width: 300, height: 300});
  view.webContents.loadURL('https://www.google.com');
  let win = createWindow();
  win.addBrowserView(view);
  await wait(2500);
  win.close();
  win = createWindow();
  win.addBrowserView(view);
}

app.on('ready', startTest);
  1. When window is recreated (on second call to createWindow) move mouse pointer over it. Browser process crashes with following stack:
>	electron.exe!electron::api::BrowserView::NonClientHitTest(const gfx::Point &) Line 115	C++
 	electron.exe!electron::NativeWindow::NonClientHitTest(const gfx::Point &) Line 692	C++
 	electron.exe!electron::NativeWindowViews::ShouldDescendIntoChildForEventHandling(aura::Window *) Line 1597	C++
 	electron.exe!views::Widget::ShouldDescendIntoChildForEventHandling(ui::Layer *) Line 1808	C++
 	electron.exe!views::DesktopNativeWidgetAura::ShouldDescendIntoChildForEventHandling(aura::Window *) Line 1201	C++
 	electron.exe!aura::WindowTargeter::SubtreeCanAcceptEvent(aura::Window *) Line 268	C++
 	electron.exe!aura::WindowTargeter::SubtreeShouldBeExploredForEvent(aura::Window *) Line 34	C++
 	electron.exe!aura::WindowTargeter::FindTargetForLocatedEventRecursively(aura::Window *) Line 336	C++
 	[Inline Frame] electron.exe!aura::WindowTargeter::FindTargetForNonKeyEvent(aura::Window *) Line 319	C++
 	electron.exe!aura::WindowTargeter::FindTargetForEvent(ui::EventTarget *) Line 185	C++
 	electron.exe!aura::WindowTargeter::FindTargetForLocatedEventRecursively(aura::Window *) Line 342	C++
 	[Inline Frame] electron.exe!aura::WindowTargeter::FindTargetForNonKeyEvent(aura::Window *) Line 319	C++
 	electron.exe!aura::WindowTargeter::FindTargetForEvent(ui::EventTarget *) Line 185	C++
 	electron.exe!ui::EventProcessor::OnEventFromSource(ui::Event *) Line 44	C++
 	electron.exe!ui::EventSource::DeliverEventToSink(ui::Event *) Line 118	C++
 	electron.exe!ui::EventSource::SendEventToSinkFromRewriter(const ui::Event *) Line 146	C++
 	electron.exe!ui::EventSource::SendEventToSink(const ui::Event *) Line 112	C++
 	electron.exe!views::DesktopWindowTreeHostWin::HandleMouseEvent(ui::MouseEvent *) Line 1049	C++
 	electron.exe!views::HWNDMessageHandler::HandleMouseEventInternal(unsigned int) Line 3315	C++
 	electron.exe!views::HWNDMessageHandler::HandleMouseMessage(unsigned int) Line 1178	C++
 	electron.exe!content::LegacyRenderWidgetHostHWND::OnMouseRange(unsigned int) Line 318	C++
 	electron.exe!content::LegacyRenderWidgetHostHWND::_ProcessWindowMessage(HWND__ *) Line 94	C++
 	electron.exe!content::LegacyRenderWidgetHostHWND::ProcessWindowMessage(HWND__ *) Line 87	C++
 	[External Code]	
 	electron.exe!base::MessagePumpForUI::ProcessMessageHelper(const tagMSG &) Line 532	C++
 	electron.exe!base::MessagePumpForUI::ProcessNextWindowsMessage() Line 498	C++
 	electron.exe!base::MessagePumpForUI::DoRunLoop() Line 209	C++
 	electron.exe!base::MessagePumpWin::Run(base::MessagePump::Delegate *) Line 79	C++
 	electron.exe!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool) Line 603	C++
 	electron.exe!base::RunLoop::Run(const base::Location &) Line 143	C++
 	electron.exe!content::BrowserMainLoop::RunMainMessageLoop() Line 1050	C++
 	electron.exe!content::BrowserMainRunnerImpl::Run() Line 163	C++
 	electron.exe!content::BrowserMain(content::MainFunctionParams) Line 30	C++
 	electron.exe!content::RunBrowserProcessMain(content::MainFunctionParams) Line 714	C++
 	electron.exe!content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams) Line 1246	C++
 	electron.exe!content::ContentMainRunnerImpl::Run() Line 1110	C++
 	electron.exe!content::RunContentProcess(content::ContentMainParams) Line 346	C++
 	electron.exe!content::ContentMain(content::ContentMainParams) Line 374	C++
 	electron.exe!wWinMain(HINSTANCE__ *) Line 244	C++
 	[External Code]

Also call win.close() willl cause a crash with another call stack.

Actual Behavior

Browser process crashes.

Testcase Gist URL

No response

Additional Information

It's a regression caused by #36230.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

    0