[Bug]: crash when re-adding BrowserView to BrowserWindow

[codebytere]

Preflight Checklist

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a bug report that matches the one I want to file, without success.

Electron Version

v22.0.0-nightly.20220919

What operating system are you using?

macOS

Operating System Version

macOS Ventura

What arch are you using?

arm64 (including Apple Silicon)

Last Known Working Electron version

v22.0.0-nightly.20220916

Expected Behavior

A BrowserView can be added to a window after it is closed and then re-created.

Actual Behavior

A crash occurs.

Stacktrace

[63405:1117/125347.774947:FATAL:electron_inspectable_web_contents_view.mm(245)] Check failed: inspectable_web_contents. 
0   Electron Framework                  0x000000011c8b01fc base::debug::CollectStackTrace(void**, unsigned long) + 28
1   Electron Framework                  0x000000011c7e9e0c base::debug::StackTrace::StackTrace() + 24
2   Electron Framework                  0x000000011c7ffda0 logging::LogMessage::~LogMessage() + 156
3   Electron Framework                  0x000000011c800b6c logging::LogMessage::~LogMessage() + 12
4   Electron Framework                  0x000000011c7e4014 logging::CheckError::~CheckError() + 36
5   Electron Framework                  0x0000000118ca6ff8 -[ElectronInspectableWebContentsView viewDidBecomeFirstResponder:] + 300
6   CoreFoundation                      0x00000001a0f7258c __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 148
7   CoreFoundation                      0x00000001a1010074 ___CFXRegistrationPost_block_invoke + 88
8   CoreFoundation                      0x00000001a100ffbc _CFXRegistrationPost + 440
9   CoreFoundation                      0x00000001a0f43bac _CFXNotificationPost + 708
10  Foundation                          0x00000001a1e3072c -[NSNotificationCenter postNotificationName:object:userInfo:] + 88
11  Electron Framework                  0x000000011be35584 -[RenderWidgetHostViewCocoa becomeFirstResponder] + 332
12  AppKit                              0x00000001a42c5954 -[NSWindow _realMakeFirstResponder:] + 360
13  Electron Framework                  0x000000011be5601c content::RenderWidgetHostViewMac::Focus() + 72
14  Electron Framework                  0x000000011bd99c30 content::WebContentsImpl::SetInitialFocus() + 76
15  Electron Framework                  0x000000011bd8dcc0 void content::WebContentsImpl::WebContentsObserverList::NotifyObservers<void (content::WebContentsObserver::*)(content::WebContents*), content::WebContentsImpl*>(void (content::WebContentsObserver::*)(content::WebContents*), content::WebContentsImpl*&&) + 628
16  Electron Framework                  0x000000011bd9dca8 content::WebContentsImpl::ReadyToCommitNavigation(content::NavigationHandle*) + 184
17  Electron Framework                  0x000000011bbb2b0c content::NavigationRequest::ReadyToCommitNavigation(bool) + 4752
18  Electron Framework                  0x000000011bba56c4 content::NavigationRequest::CommitNavigation() + 1200
19  Electron Framework                  0x000000011bbb14e0 content::NavigationRequest::OnCommitDeferringConditionChecksComplete(content::CommitDeferringCondition::NavigationType, absl::optional<int>) + 192
20  Electron Framework                  0x000000011baecea8 content::CommitDeferringConditionRunner::ProcessConditions() + 532
21  Electron Framework                  0x000000011bbb0e1c content::NavigationRequest::OnWillProcessResponseChecksComplete(content::NavigationThrottle::ThrottleCheckResult) + 748
22  Electron Framework                  0x000000011bbb541c content::NavigationRequest::OnWillProcessResponseProcessed(content::NavigationThrottle::ThrottleCheckResult) + 556
23  Electron Framework                  0x000000011bbb4a88 content::NavigationRequest::OnNavigationEventProcessed(content::NavigationThrottleRunner::Event, content::NavigationThrottle::ThrottleCheckResult) + 376
24  Electron Framework                  0x000000011bbc1944 content::NavigationThrottleRunner::ProcessInternal() + 864
25  Electron Framework                  0x000000011bbc15d0 content::NavigationThrottleRunner::ProcessNavigationEvent(content::NavigationThrottleRunner::Event) + 136
26  Electron Framework                  0x000000011bbacfbc content::NavigationRequest::WillProcessResponse() + 200
27  Electron Framework                  0x000000011bbabe30 content::NavigationRequest::OnResponseStarted(mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, content::GlobalRequestID, bool, blink::NavigationDownloadPolicy, net::NetworkAnonymizationKey, absl::optional<content::SubresourceLoaderParams>, content::NavigationURLLoaderDelegate::EarlyHints) + 5344
28  Electron Framework                  0x000000011b9e6930 content::NavigationURLLoaderImpl::NotifyResponseStarted(mojo::StructPtr<network::mojom::URLResponseHead>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, content::GlobalRequestID const&, bool) + 356
29  Electron Framework                  0x000000011b9ea5e4 void base::internal::FunctorTraits<void (content::NavigationURLLoaderImpl::*)(mojo::StructPtr<network::mojom::URLResponseHead>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, content::GlobalRequestID const&, bool), void>::Invoke<void (content::NavigationURLLoaderImpl::*)(mojo::StructPtr<network::mojom::URLResponseHead>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, content::GlobalRequestID const&, bool), base::WeakPtr<content::NavigationURLLoaderImpl>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, content::GlobalRequestID, bool>(void (content::NavigationURLLoaderImpl::*)(mojo::StructPtr<network::mojom::URLResponseHead>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, content::GlobalRequestID const&, bool), base::WeakPtr<content::NavigationURLLoaderImpl>&&, mojo::StructPtr<network::mojom::URLResponseHead>&&, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>&&, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>&&, content::GlobalRequestID&&, bool&&) + 148
30  Electron Framework                  0x000000011b9eb4d8 _ZN4base8internal7InvokerINS0_9BindStateIZN7content23NavigationURLLoaderImpl12ParseHeadersERK4GURLPN7network5mojom15URLResponseHeadENS_12OnceCallbackIFvvEEEE3$_0JSE_NS0_17UnretainedWrapperISA_NS_28RawPtrBanDanglingIfSupportedEEEEEEFvN4mojo9StructPtrINS9_13ParsedHeadersEEEEE7RunOnceEPNS0_13BindStateBaseEOSN_ + 1524
31  Electron Framework                  0x0000000118f56ca8 network::mojom::NetworkService_ParseHeaders_ForwardToCallback::Accept(mojo::Message*) + 108
32  Electron Framework                  0x000000011cbd6654 mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) + 820
33  Electron Framework                  0x000000011cbdc190 mojo::MessageDispatcher::Accept(mojo::Message*) + 256
34  Electron Framework                  0x000000011cbd8260 mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) + 96
35  Electron Framework                  0x000000011cbe1930 mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) + 1060
36  Electron Framework                  0x000000011cbe0f14 mojo::internal::MultiplexRouter::Accept(mojo::Message*) + 364
37  Electron Framework                  0x000000011cbdc190 mojo::MessageDispatcher::Accept(mojo::Message*) + 256
38  Electron Framework                  0x000000011cbd1f6c mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) + 452
39  Electron Framework                  0x000000011cbd29d0 mojo::Connector::ReadAllAvailableMessages() + 164
40  Electron Framework                  0x000000011cbd27e4 mojo::Connector::OnWatcherHandleReady(unsigned int) + 72
41  Electron Framework                  0x0000000118b139b8 mojo::SimpleWatcher::DiscardReadyState(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&) + 64
42  Electron Framework                  0x000000011cbfaba0 mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) + 276
43  Electron Framework                  0x000000011cbfb094 base::internal::Invoker<base::internal::BindState<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::Simp
leWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) + 104
44  Electron Framework                  0x000000011c84cfa0 base::TaskAnnotator::RunTaskImpl(base::PendingTask&) + 284
45  Electron Framework                  0x000000011c870f50 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) + 1232
46  Electron Framework                  0x000000011c87059c base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() + 108
47  Electron Framework                  0x000000011c8c2930 base::MessagePumpCFRunLoopBase::RunWork() + 100
48  Electron Framework                  0x000000011c8c19d0 base::mac::CallWithEHFrame(void () block_pointer) + 16
49  Electron Framework                  0x000000011c8c1f40 base::MessagePumpCFRunLoopBase::RunWorkSource(void*) + 68
50  CoreFoundation                      0x00000001a0f7da34 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 28
51  CoreFoundation                      0x00000001a0f7d9c8 __CFRunLoopDoSource0 + 176
52  CoreFoundation                      0x00000001a0f7d798 __CFRunLoopDoSources0 + 340
53  CoreFoundation                      0x00000001a0f7c33c __CFRunLoopRun + 836
54  CoreFoundation                      0x00000001a0f7b8a4 CFRunLoopRunSpecific + 612
55  HIToolbox                           0x00000001aa5ef3bc RunCurrentEventLoopInMode + 292
56  HIToolbox                           0x00000001aa5ef200 ReceiveNextEventCommon + 672
57  HIToolbox                           0x00000001aa5eef48 _BlockUntilNextEventMatchingListInModeWithFilter + 72
58  AppKit                              0x00000001a41d4630 _DPSNextEvent + 632
59  AppKit                              0x00000001a41d37c0 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 728
60  AppKit                              0x00000001a41c7bf0 -[NSApplication run] + 464
61  Electron Framework                  0x000000011c8c3350 base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) + 264
62  Electron Framework                  0x000000011c8c1a7c base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) + 156
63  Electron Framework                  0x000000011c871c8c base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) + 432
64  Electron Framework                  0x000000011c82cbe4 base::RunLoop::Run(base::Location const&) + 568
65  Electron Framework                  0x000000011b734c5c content::BrowserMainLoop::RunMainMessageLoop() + 184
66  Electron Framework                  0x000000011b736b7c content::BrowserMainRunnerImpl::Run() + 44
67  Electron Framework                  0x000000011b7321f4 content::BrowserMain(content::MainFunctionParams) + 244
68  Electron Framework                  0x0000000118df4618 content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) + 256
69  Electron Framework                  0x0000000118df59a8 content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) + 620
70  Electron Framework                  0x0000000118df55f0 content::ContentMainRunnerImpl::Run() + 752
71  Electron Framework                  0x0000000118df3ce4 content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) + 1536
72  Electron Framework                  0x0000000118df3ebc content::ContentMain(content::ContentMainParams) + 92
73  Electron Framework                  0x0000000118aced0c ElectronMain + 128
74  dyld                                0x00000001a0b73e50 start + 2544
Task trace:
0   Electron Framework                  0x000000011cbfae58 mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) + 208
Crash keys:
  "amfi-status" = "rv=0 status=0x0 allow_everything=0"
  "ui_scheduler_async_stack" = "0x11CBFAE58 0x0"
  "navigation_request_is_same_document" = "cross-doc"
  "navigation_request_url" = "https://www.electronjs.org/"
  "navigation_request_initiator" = "nullptr"
  "io_scheduler_async_stack" = "0x11CBFAE58 0x0"
  "platform" = "darwin"
  "process_type" = "browser"

Electron exited with signal SIGTRAP.

Testcase Gist URL

https://gist.github.com/d21eb8a039ab31faa910384a4ba3200c

Additional Information

Caused by #35509.

Tracked to v22.0.0-nightly.20220916...v22.0.0-nightly.20220919.

cc @nornagon

[deepak1556]

I looked into this today while investigating another issue which had similar stack microsoft/vscode#167936. For this issue, the following sequence happens

1. BrowserWindow::Close triggers async destruction path for its WebContents and also the child BrowserViews

2. BrowserWindow::AddBrowserView increases the ref count of the underlying ElectronInspectableWebContentsView. At this point in time, the destruction of the native objects from 1) has not started yet. So the underlying view and inspectable webcontents are still valid.

3. Destruction now starts and finishes with top-level WebContents of the previous BrowserWindow. Next destruction of WebContents associated with BrowserView begins and this destroys the InspectableWebContents owned by the api::WebContents, also releases reference to the ElectronInspectableWebContentsView but this does not lead to triggering the dealloc method since the reference from 2) is still present.

4. We are now in a situation where the view is still subscribed to notifications but the owner InspectableWebContents has been freed which leads to the above crash on focus change.

[deepak1556]

The test case in this issue reuses a BrowserView that is marked for destruction, question is should we internally mark the BrowserView for destruction, make the AddBrowserView call a no-op and throw explicit error to Users ? or if we want to cancel the destruction of BrowserView to support reparenting it ?

[github-actions]

This issue has been automatically marked as stale. If this issue is still affecting you, please leave any comment (for example, "bump"), and we'll keep it open. If you have any new additional information—in particular, if this is still reproducible in the latest version of Electron or in the beta—please include it with your comment!

[pushkin-]

bump

[github-actions]

This issue has been automatically marked as stale. If this issue is still affecting you, please leave any comment (for example, "bump"), and we'll keep it open. If you have any new additional information—in particular, if this is still reproducible in the latest version of Electron or in the beta—please include it with your comment!

[codebytere]

Closed by #39387