4.0 crashes on shutdown when using BrowserView

[PalmerAL]

• Output of node_modules/.bin/electron --version: 4.0.0-beta.3
• Operating System (Platform and Version): macOS 10.13.5
• Output of node_modules/.bin/electron --version on last known working Electron version (if applicable): 3.0.3

Expected Behavior
Electron shouldn't crash.

Actual behavior
A crash occurs.

To Reproduce

• Make a copy of electron-quick-start, and add the following to main.js:

const BrowserView = require("electron").BrowserView;
app.on('ready', function () {
  new BrowserView({})
})

• Quit the app.

Crash report:

Crashed Thread:        0  CrBrowserMain  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Segmentation fault: 11
Termination Reason:    Namespace SIGNAL, Code 0xb
Terminating Process:   exc handler [0]

VM Regions Near 0:
--> 
    __TEXT                 000000010283e000-000000010283f000 [    4K] r-x/rwx SM=COW  /Users/USER/Documents/*/Electron.app/Contents/MacOS/Electron

Thread 0 Crashed:: CrBrowserMain  Dispatch queue: com.apple.main-thread
0   com.github.Electron.framework 	0x00000001081f8d45 0x10740c000 + 14601541
1   com.github.Electron.framework 	0x00000001081f9cfe 0x10740c000 + 14605566
2   com.github.Electron.framework 	0x000000010919563b 0x10740c000 + 30971451
3   com.github.Electron.framework 	0x000000010919574e 0x10740c000 + 30971726
4   com.github.Electron.framework 	0x00000001090e9ef2 0x10740c000 + 30269170
5   com.github.Electron.framework 	0x00000001091c4e31 0x10740c000 + 31166001
6   com.github.Electron.framework 	0x00000001091c59e2 0x10740c000 + 31168994
7   com.github.Electron.framework 	0x00000001091cf98e 0x10740c000 + 31209870
8   com.github.Electron.framework 	0x000000010902f828 0x10740c000 + 29505576
9   com.github.Electron.framework 	0x000000010a45e731 0x10740c000 + 50669361
10  com.github.Electron.framework 	0x0000000108e5a8c4 0x10740c000 + 27584708
11  com.github.Electron.framework 	0x000000010740e114 AtomMain + 84
12  libdyld.dylib                 	0x00007fff78bb7015 start + 1

[caesar]

I'm getting this without a BrowserView too.

Simply open the unmodified Electron.app from the NPM bundle for 4.0.0-beta.5, and quit it, and it crashes as above.

But only on macOS. Or at least I only get a Problem Report pop up on macOS, but maybe I wouldn't notice anything on other platforms.

[zcbenz]

Detailed stack trace:

[45340:1101/151324.572886:FATAL:resource_scheduler.cc(999)] Check failed: client_map_.empty(). 
0   Electron Framework                  0x000000010c1e752c base::debug::StackTrace::StackTrace(unsigned long) + 28
1   Electron Framework                  0x000000010c0d12e1 logging::LogMessage::~LogMessage() + 225
2   Electron Framework                  0x000000010d851044 network::ResourceScheduler::~ResourceScheduler() + 244
3   Electron Framework                  0x000000010a12abaf content::ResourceDispatcherHostImpl::OnShutdown() + 911
4   Electron Framework                  0x000000010c0af056 base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) + 358
5   Electron Framework                  0x000000010c0e7d6f base::MessageLoop::RunTask(base::PendingTask*) + 639
6   Electron Framework                  0x000000010c0e83ca base::MessageLoop::DoWork() + 474
7   Electron Framework                  0x000000010c204f74 base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) + 244
8   Electron Framework                  0x000000010c0e75fc base::MessageLoop::Run(bool) + 332
9   Electron Framework                  0x000000010c130b29 base::RunLoop::Run() + 249
10  Electron Framework                  0x000000010c18611e base::Thread::Run(base::RunLoop*) + 206
11  Electron Framework                  0x0000000109e46654 content::BrowserProcessSubThread::IOThreadRun(base::RunLoop*) + 20
12  Electron Framework                  0x0000000109e465f4 content::BrowserProcessSubThread::Run(base::RunLoop*) + 212
13  Electron Framework                  0x000000010c19765e base::Thread::ThreadMain() + 782
14  Electron Framework                  0x000000010c2055bf base::(anonymous namespace)::ThreadFunc(void*) + 95
15  libsystem_pthread.dylib             0x00007fff7459b661 _pthread_body + 340
16  libsystem_pthread.dylib             0x00007fff7459b50d _pthread_body + 0
17  libsystem_pthread.dylib             0x00007fff7459abf9 thread_start + 13

[zcbenz]

The crash happens when we force destroying a WebContents (web_contents.reset()), it seems that Chromium does not clean up all resources of WebContents immediately in this case.

[zcbenz]

After further investigation, I think the crash is caused by web_contents.reset() being delayed to next tick on shutdown, which makes content::ResourceDispatcherHostImpl::OnShutdown being called while there are still WebContents alive.

[deepak1556]

content::ResourceDispatcherHostImpl destroys only when the main thread is cleaned up and we post the webContents destruction on the main thread task runner, does this mean the task is actually run after the thread is cleaned up or the task never ran, probably requires force flushing before shutdown ?

[deepak1556]

The same crash was present in 69 upgrade, and the reason there was the destruction task never ran, https://github.com/electron/electron/blob/master/patches/common/chromium/content_browser_main_loop.patch was added to force that. Maybe it regressed ?

[zcbenz]

After adding some logging it looks like the cleanup task now runs after ResourceDispatcherHostImpl::OnShutdown, probably the behavior of shutting down has changed.

I'm going to try tweaking our destroying strategy of WebContents, we should be able to avoid this situation at all.