[Bug]: App Crashes when a new foreground tab is opened from a webview with nativeWindowOpen and allowPopups

[praneetrohida]

Preflight Checklist

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a feature request that matches the one I want to file, without success.

Electron Version

12.0.1

What operating system are you using?

macOS

Operating System Version

11.2

What arch are you using?

x64

Last Known Working Electron version

11.x

Expected Behavior

The app should not crash, and the new-window event should be fired

Actual Behavior

The app crashes

Testcase Gist URL

https://gist.github.com/ae7fdfd99a5d755a5ae4323c46a4e833

[praneetrohida]

I can confirm that this issue is also present on 12.0.2

[codebytere]

@praneetrohida i ran this and could not reproduce - do you have a stack trace or more information?

[praneetrohida]

@codebytere here is the Stack trace from fiddle and the screencast of the bug

Stack Trace

Saved files to /var/folders/yl/r_sqlm4j4dzdbfp22bhfnws40000gn/T/tmp-65177-lQDRwrYwPm8z
Electron v12.0.2 started.
[65220:0330/105837.655022:INFO:CONSOLE(113)] "%cElectron Security Warning (allowpopups) font-weight: bold; A <webview> has "allowpopups" set to true. This exposes
    users of this app to some security risk, since popups are just
    BrowserWindows. If you do not need this feature, you should disable it.
    
For more information and help, consult
https://electronjs.org/docs/tutorial/security.
This warning will not show up
once the app is packaged.", source: electron/js2c/renderer_init.js (113)
[65220:0330/105837.655165:INFO:CONSOLE(113)] "%cElectron Security Warning (Insecure Content-Security-Policy) font-weight: bold; This renderer process has either no Content Security
    Policy set or a policy with "unsafe-eval" enabled. This exposes users of
    this app to unnecessary security risks.
For more information and help, consult
https://electronjs.org/docs/tutorial/security.
This warning will not show up
once the app is packaged.", source: electron/js2c/renderer_init.js (113)
[65220:0330/105839.294445:INFO:CONSOLE(113)] "%cElectron Security Warning (enableRemoteModule) font-weight: bold; This renderer process has "enableRemoteModule" enabled
    and attempted to load remote content from 'https://reactjs.org/'. This
    exposes users of this app to unnecessary security risks.
For more information and help, consult
https://electronjs.org/docs/tutorial/security.
This warning will not show up
once the app is packaged.", source: electron/js2c/renderer_init.js (113)
[65220:0330/105839.294519:INFO:CONSOLE(113)] "%cElectron Security Warning (Insecure Content-Security-Policy) font-weight: bold; This renderer process has either no Content Security
    Policy set or a policy with "unsafe-eval" enabled. This exposes users of
    this app to unnecessary security risks.
For more information and help, consult
https://electronjs.org/docs/tutorial/security.
This warning will not show up
once the app is packaged.", source: electron/js2c/renderer_init.js (113)
Received signal 11 SEGV_MAPERR 000000000008
 [0x000106990369]
 [0x000109a82a33]
 [0x000109aad3eb]
 [0x7fff204eed7d]
 [0x00010692b41c]
 [0x00010580019a]
 [0x0001057fffe3]
 [0x000105800368]
 [0x0001067b6523]
 [0x0001092a1c23]
 [0x0001087c8c81]
 [0x0001092a8d2b]
 [0x000106ae5adf]
 [0x000106ae7cf6]
 [0x000106c25594]
 [0x0001069590f9]
 [0x00010696773e]
 [0x00010696725e]
 [0x00010699b953]
 [0x0001069983ea
]
 [0x00010699b31f]
 [0x7fff205a2a0c]
 [0x7fff205a2974]
 [0x7fff205a26ef]
 [0x7fff205a1121]
 [0x7fff205a06ce]
 [0x7fff28828630]
 [0x7fff2882842c]
 [0x7fff2882814f]
 [0x7fff22dc09b1]
 [0x7fff22dbf177]
 [0x7fff22db168a]
 [0x00010699bf26]
 [0x00010699aeab]
 [0x00010696819f]
 [0x0001069454b9]
 [0x000109066084]
 [0x0001065c66e2]
 [0x0001065c2089]
 [0x000105d2ac46]
 [0x000105d2a953]
 [0x000105d29620]
 [0x000105d29ae2]
 [0x000105778dc8]
 [0x000102b16426]
 [0x7fff204c5621]
 [0x000000000003]
[end of stack trace]
Electron exited.

CleanShot.2021-03-30.at.11.02.11.mp4

[nornagon]

I can reproduce this with the steps in the video.

Symbolicated crash stack:

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x8
Process uptime: 6 seconds

Thread 0 (crashed)
 0  Electron Framework!blink::mojom::FrameWidgetProxy::SetActive(bool) [widget.mojom.cc : 597 + 0x0]
    rax = 0x0000000000000000   rdx = 0xa648ade9f8da1f8f
    rcx = 0x0000000000000000   rbx = 0x00007ffee56d59d0
    rsi = 0x00007ffee56d5a50   rdi = 0x00007ffee56d59d0
    rbp = 0x00007ffee56d5ac0   rsp = 0x00007ffee56d59d0
     r8 = 0x0000000000000000    r9 = 0x000000000000c743
    r10 = 0x00000000fffffff8   r11 = 0x00007f981e4743d8
    r12 = 0x00007ffee56d5a50   r13 = 0x00007ffee56d59d8
    r14 = 0x0000000000000018   r15 = 0x0000000000000001
    rip = 0x000000010d586da8
    Found by: given as instruction pointer in context
 1  Electron Framework!content::RenderWidgetHostViewMac::SetActive(bool) [render_widget_host_view_mac.mm : 1326 + 0xd]
    rbp = 0x00007ffee56d5af0   rsp = 0x00007ffee56d5ad0
    rip = 0x000000010e26a336
    Found by: previous frame's frame pointer
 2  Electron Framework!electron::NativeWindow::NotifyWindowIsKeyChanged(bool) [native_window.cc : 450 + 0x9]
    rbp = 0x00007ffee56d5b80   rsp = 0x00007ffee56d5b00
    rip = 0x000000010a67c714
    Found by: previous frame's frame pointer
 3  CoreFoundation!__CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 0xc
    rbp = 0x00007ffee56d5b90   rsp = 0x00007ffee56d5b90
    rip = 0x00007fff36a8c80f
    Found by: previous frame's frame pointer
 4  CoreFoundation!___CFXRegistrationPost1_block_invoke + 0x3f
    rbp = 0x00007ffee56d5bb0   rsp = 0x00007ffee56d5ba0
    rip = 0x00007fff36a8c7a3
    Found by: previous frame's frame pointer
 5  CoreFoundation!_CFXRegistrationPost1 + 0x174
    rbp = 0x00007ffee56d5c30   rsp = 0x00007ffee56d5bc0
    rip = 0x00007fff36a8c718
    Found by: previous frame's frame pointer
 6  CoreFoundation!___CFXNotificationPost_block_invoke + 0x50
    rbp = 0x00007ffee56d5c70   rsp = 0x00007ffee56d5c40
    rip = 0x00007fff36a8c384
    Found by: previous frame's frame pointer
 7  CoreFoundation!-[_CFXNotificationRegistrar find:object:observer:enumerator:] + 0x612
    rbp = 0x00007ffee56d6390   rsp = 0x00007ffee56d5c80
    rip = 0x00007fff36a5c4fd
    Found by: previous frame's frame pointer
 8  CoreFoundation!_CFXNotificationPost + 0x547
    rbp = 0x00007ffee56d6620   rsp = 0x00007ffee56d63a0
    rip = 0x00007fff36a5b9a9
    Found by: previous frame's frame pointer
 9  Foundation!-[NSNotificationCenter postNotificationName:object:userInfo:] + 0x3b
    rbp = 0x00007ffee56d6650   rsp = 0x00007ffee56d6630
    rip = 0x00007fff390d9746
    Found by: previous frame's frame pointer
10  AppKit!-[NSWindow becomeKeyWindow] + 0x4fc
    rbp = 0x00007ffee56d66a0   rsp = 0x00007ffee56d6660
    rip = 0x00007fff33ee1495
    Found by: previous frame's frame pointer
11  AppKit!-[NSWindow _changeKeyAndMainLimitedOK:] + 0x3c3
    rbp = 0x00007ffee56d6700   rsp = 0x00007ffee56d66b0
    rip = 0x00007fff33e63feb
    Found by: previous frame's frame pointer
12  AppKit!-[NSWindow _makeKeyRegardlessOfVisibility] + 0x4c
    rbp = 0x00007ffee56d6730   rsp = 0x00007ffee56d6710
    rip = 0x00007fff33e63af1
    Found by: previous frame's frame pointer
13  AppKit!-[NSWindow makeKeyAndOrderFront:] + 0x28
    rbp = 0x00007ffee56d6750   rsp = 0x00007ffee56d6740
    rip = 0x00007fff33e57340
    Found by: previous frame's frame pointer
14  Electron Framework!electron::NativeWindow::InitFromOptions(gin_helper::Dictionary const&) [native_window.cc : 181 + 0xa]
    rbp = 0x00007ffee56d6820   rsp = 0x00007ffee56d6760
    rip = 0x000000010a67ada4
    Found by: previous frame's frame pointer
15  Electron Framework!electron::api::BrowserWindow::BrowserWindow(gin::Arguments*, gin_helper::Dictionary const&) [electron_api_browser_window.cc : 103 + 0x5]
    rbp = 0x00007ffee56d68f0   rsp = 0x00007ffee56d6830
    rip = 0x000000010a5ca02a
    Found by: previous frame's frame pointer
16  Electron Framework!electron::api::BrowserWindow::New(gin_helper::ErrorThrower, gin::Arguments*) [electron_api_browser_window.cc : 35 + 0xe]
    rbp = 0x00007ffee56d6950   rsp = 0x00007ffee56d6900
    rip = 0x000000010a5cbde7
    Found by: previous frame's frame pointer
17  Electron Framework!base::internal::Invoker<base::internal::BindState<gin_helper::WrappableBase* (*)(gin_helper::ErrorThrower, gin::Arguments*)>, gin_helper::WrappableBase* (gin_helper::ErrorThrower, gin::Arguments*)>::Run(base::internal::BindStateBase*, gin_helper::ErrorThrower&&, gin::Arguments*) [bind_internal.h : 393 + 0x8]
    rbp = 0x00007ffee56d6980   rsp = 0x00007ffee56d6960
    rip = 0x000000010a5cc501
    Found by: previous frame's frame pointer
18  Electron Framework!void gin_helper::internal::InvokeNew<gin_helper::WrappableBase* (gin_helper::ErrorThrower, gin::Arguments*)>(base::RepeatingCallback<gin_helper::WrappableBase* (gin_helper::ErrorThrower, gin::Arguments*)> const&, v8::Isolate*, gin_helper::Arguments*) [callback.h : 168 + 0x9]
    rbp = 0x00007ffee56d6a00   rsp = 0x00007ffee56d6990
    rip = 0x000000010a5cc41e
    Found by: previous frame's frame pointer
19  Electron Framework!gin_helper::Dispatcher<void (v8::Isolate*, gin_helper::Arguments*)>::DispatchToCallback(v8::FunctionCallbackInfo<v8::Value> const&) [callback.h : 168 + 0x3]
    rbp = 0x00007ffee56d6a90   rsp = 0x00007ffee56d6a10
    rip = 0x000000010a5bf09e
    Found by: previous frame's frame pointer
20  Electron Framework!v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo) [api-arguments-inl.h : 158 + 0x3]
    rbp = 0x00007ffee56d6b80   rsp = 0x00007ffee56d6aa0
    rip = 0x000000010abe9810
    Found by: previous frame's frame pointer
[...]

e4cc0acb-f675-4e74-8aba-ed7680ffe882.dmp.zip

Bisected to v12.0.0-nightly.20200914...v12.0.0-nightly.20201013

[agata]

This problem does not occur in 12.0.0, but in 12.0.1, 12.0.2, and 13.0.0-beta.9.

[praneetrohida]

Any updates on this? I can confirm this issue still exists on 12.0.6

[PauIGB]

I also have this issue on Windows 10 on electron 12.x versions (electron 11.x works fine)
<webview webpreferences="nativeWindowOpen=true" allowpopups src="child.html"></webview>
For example: app crashes when <a href="https://expamle.com" target="_blank"> exmple</a> clicked in child.html.

const { app, BrowserWindow } = require('electron')
const path = require('path')

function createWindow () {
  const win = new BrowserWindow({
    width: 800,
    height: 600,
    webPreferences: {
      webviewTag: true,
    }
  })

  win.loadFile('index.html')
}

app.whenReady().then(() => {
  createWindow() 
})```

[jpschw]

We are experiencing crashes with nativeWindowOpen on 13.x as well.