fix: crash calling removeBrowserView() with destroyed webContents

#37642
electron · Jun 19, 2023 · 1ed1417 · 1ed1417
1 parent 41ab5f3
commit 1ed1417
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 0 deletions.
diff --git a/shell/browser/api/electron_api_browser_view.cc b/shell/browser/api/electron_api_browser_view.cc
@@ -131,6 +131,10 @@ void BrowserView::WebContentsDestroyed() {
   Unpin();
 }
 
+void BrowserView::OnCloseContents() {
+  api_web_contents_ = nullptr;
+}
+
 // static
 gin::Handle<BrowserView> BrowserView::New(gin_helper::ErrorThrower thrower,
                                           gin::Arguments* args) {

diff --git a/shell/browser/api/electron_api_browser_view.h b/shell/browser/api/electron_api_browser_view.h
@@ -71,6 +71,9 @@ class BrowserView : public gin::Wrappable<BrowserView>,
   // content::WebContentsObserver:
   void WebContentsDestroyed() override;
 
+  // ExtendedWebContentsObserver:
+  void OnCloseContents() override;
+
  private:
   void SetAutoResize(AutoResizeFlags flags);
   void SetBounds(const gfx::Rect& bounds);

diff --git a/spec/api-browser-view-spec.ts b/spec/api-browser-view-spec.ts
@@ -257,6 +257,20 @@ describe('BrowserView module', () => {
         w.removeBrowserView(view);
       }).to.not.throw();
     });
+
+    it('can be called on a BrowserView with a destroyed webContents', (done) => {
+      view = new BrowserView();
+      w.addBrowserView(view);
+
+      view.webContents.on('destroyed', () => {
+        w.removeBrowserView(view);
+        done();
+      });
+
+      view.webContents.loadURL('data:text/html,hello there').then(() => {
+        view.webContents.close();
+      });
+    });
   });
 
   describe('BrowserWindow.getBrowserViews()', () => {