[Bug]: FramelessView::NonClientHitTest sporadically crashes application when calling view_draggable_region->contains(cursor.x(), cursor.y())

[arctictron]

Preflight Checklist

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a feature request that matches the one I want to file, without success.

Electron Version

15.1.0

What operating system are you using?

Windows

Operating System Version

Windows 10 version 21H1

What arch are you using?

x64

Last Known Working Electron version

No response

Expected Behavior

Should return true or false when checking if the cursor is in a draggable region of a browserview.

Actual Behavior

It appears that sporadically that the view_draggable_region may not be valid, thus when checking if the cursor is contained within the SkRegion by calling SkRegion::contains, an uncaught exception happens on line 359 of SkRegion.cpp that results in electron crashing.

Testcase Gist URL

No response

Additional Information

I don't have any code to share as this happens sporadically from it will only take one click to several clicks in the widow for it to crash. What I can say is that I am using a frameless window with a browserview acting as the title bar that has a draggable region, then 1+ other browserviews serving the main content that do not have draggable regions. Crashes can happen ether when clicking within the title bar or main content browserviews.

I have tried several versions of electron from 11.x.x, 12.x.x, 13.x.x, and 15.x.x and they all exhibit this behavior.

[clavin]

Thanks for reporting this and helping to make Electron better!

Would it be possible for you to make a standalone test case with only the code necessary to reproduce the issue? Electron Fiddle is a great tool for making small test cases and publishing them as gists that Electron maintainers can use.

I understand that the crash happens sporadically, but it helps us to have a minimal repro that you know causes the issue so we can start seeing if we can reproduce it on the same exact setup too.

I'm adding the blocked/need-repro label for this reason. After you make a test case, please link to it in a followup comment.

Thanks in advance! Your help is appreciated.

[codebytere]

We haven't gotten a response to our questions in our comment above. With only the information that is currently in the issue, we don't have enough information to take action. In this event, i'm going to go ahead and close this but can reopen should you follow up with more info!

[arctictron]

I have spent some time trying to get an electron fiddle setup to recreate the issue, but have not been able to get it to crash. I do have several crash dump files that I can share if that will be helpful.

[arctictron]

Here's an example callstack

[ 00 ] SkRegion::contains(int,int)
[ 01 ] electron::FramelessView::NonClientHitTest(gfx::Point const &)
[ 02 ] electron::WinFrameView::NonClientHitTest(gfx::Point const &)
[ 03 ] gfx::ScaleToFlooredPoint(gfx::Point const &,float)
[ 04 ] views::Widget::GetNonClientComponent(gfx::Point const &)
[ 05 ] views::DesktopWindowTreeHostWin::GetNonClientComponent(gfx::Point const &)
[ 06 ] MapWindowPoints
[ 07 ] views::HWNDMessageHandler::OnNCHitTest(gfx::Point const &)
[ 08 ] RtlUnwind
[ 09 ] ui::ViewProp::Data::Get(HWND__ *,char const *,bool,scoped_refptr<ui::ViewProp::Data> *)
[ 10 ] RtlUnwind
[ 11 ] views::HWNDMessageHandler::HandleNcHitTestMessage(unsigned int,unsigned __int64,__int64,bool *)
[ 12 ] content::LegacyRenderWidgetHostHWND::_ProcessWindowMessage(HWND__ *,unsigned int,unsigned __int64,__int64,__int64 &,unsigned long)
[ 13 ] free
[ 14 ] 0x645000f90f60
[ 15 ] content::LegacyRenderWidgetHostHWND::ProcessWindowMessage(HWND__ *,unsigned int,unsigned __int64,__int64,__int64 &,unsigned long)
[ 16 ] ATL::CWindowImplBaseT<ATL::CWindow,ATL::CWinTraits<1073741824,0> >::WindowProc(HWND__ *,unsigned int,unsigned __int64,__int64)
[ 17 ] RtlActivateActivationContextUnsafeFast
[ 18 ] int64_t UserCallWinProcCheckWow(struct _ACTIVATION_CONTEXT *,int64_t ( *)(struct tagWND *,unsigned int,uint64_t,int64_t),struct HWND__*,enum _WM_VALUE,uint64_t,int64_t,void *,int)
[ 19 ] DispatchClientMessage
[ 20 ] _fnDWORD
[ 21 ] KiUserCallbackDispatch
[ 22 ] ZwUserPeekMessage
[ 23 ] int _PeekMessage(struct tagMSG *,struct HWND__*,unsigned int,unsigned int,unsigned int,unsigned int,int)
[ 24 ] PeekMessageW
[ 25 ] base::MessagePumpForUI::ProcessMessageHelper(tagMSG const &)
[ 26 ] base::RunLoop::Delegate::ShouldQuitWhenIdle()
[ 27 ] base::MessagePumpForUI::WaitForWork(base::MessagePump::Delegate::NextWorkInfo)
[ 28 ] int _PeekMessage(struct tagMSG *,struct HWND__*,unsigned int,unsigned int,unsigned int,unsigned int,int)
[ 29 ] PeekMessageW
[ 30 ] base::MessagePumpForUI::DoRunLoop()
[ 31 ] base::sequence_manager::internal::ThreadController::RunLevelTracker::OnRunLoopEnded()
[ 32 ] base::sequence_manager::internal::ThreadController::RunLevelTracker::RunLevel::UpdateState(base::sequence_manager::internal::ThreadController::RunLevelTracker::State)
[ 33 ] base::MessagePumpWin::Run(base::MessagePump::Delegate *)
[ 34 ] malloc(unsigned __int64)
[ 35 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool,base::TimeDelta)
[ 36 ] base::RunLoop::Run(base::Location const &)
[ 37 ] base::internal::WeakPtrFactoryBase::WeakPtrFactoryBase(unsigned __int64)
[ 38 ] base::RunLoop::Run(base::Location const &)
[ 39 ] base::RunLoop::RunUntilIdle()
[ 40 ] content::BrowserMainLoop::RunMainMessageLoop()
[ 41 ] RtlUnwind
[ 42 ] RtlUnwind
[ 43 ] content::BrowserMainLoop::RunMainMessageLoop()
[ 44 ] content::BrowserMainRunnerImpl::Run()
[ 45 ] content::BrowserMain(content::MainFunctionParams const &)
[ 46 ] _Init_thread_unlock()
[ 47 ] _Init_thread_footer(int *)
[ 48 ] operator new(unsigned __int64)
[ 49 ] content::internal::PartitionAllocSupport::ReconfigureAfterTaskRunnerInit(std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char> > const &)
[ 50 ] std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char> >::basic_string<nullptr_t>(char const *)
[ 51 ] content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams &,bool)
[ 52 ] RtlUnwind
[ 53 ] RunOtherNamedProcessTypeMain(std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char> > const &,content::MainFunctionParams const &,content::ContentMainDelegate *)
[ 54 ] RunOtherNamedProcessTypeMain(std::__1::basic_string<char,std::__1::char_traits<char>,std::__1::allocator<char> > const &,content::MainFunctionParams const &,content::ContentMainDelegate *)
[ 55 ] content::ContentMainRunnerImpl::Run(bool)
[ 56 ] RtlUnwind
[ 57 ] base::CommandLine::HasSwitch(char const *)
[ 58 ] RtlUnwind
[ 59 ] content::RunContentProcess(content::ContentMainParams const &,content::ContentMainRunner *)
[ 60 ] RtlUnwind
[ 61 ] LdrControlFlowGuardEnforcedWithExportSuppression