Skip to content

fix: Crash for Notification close#51597

Merged
ckerr merged 1 commit into
electron:mainfrom
wujinli:notification_crash
May 15, 2026
Merged

fix: Crash for Notification close#51597
ckerr merged 1 commit into
electron:mainfrom
wujinli:notification_crash

Conversation

@wujinli
Copy link
Copy Markdown
Contributor

@wujinli wujinli commented May 13, 2026

On the macOS platform, calling the close function again in the close event of a Notification will cause a crash. The specific reason is as follows: When the close function of a Notification is called, the dismiss logic dispatches a "close" event. If the close function is called again in the close event, it will reset |notification_|, causing the weakptr to become invalid. The first close function will continue to use this invalid weakptr directly, thus triggering a crash.

Description of Change

(lldb) bt
warning: Electron Framework was compiled with optimization - stepping may behave oddly; variables may not be available.
* thread #1, name = 'CrBrowserMain', queue = 'com.apple.main-thread', stop reason = EXC_BREAKPOINT (code=1, subcode=0x10d33e824)
  * frame #0: 0x000000010d33e824 Electron Framework`base::ImmediateCrash() at immediate_crash.h:186:3 [opt] [inlined]
    frame #1: 0x000000010d33e824 Electron Framework`logging::CheckFailure() at check.h:258:3 [opt] [inlined]
    frame #2: 0x000000010d33e824 Electron Framework`base::WeakPtr<electron::Notification>::operator->(this=<unavailable>) const at weak_ptr.h:249:5 [opt] [inlined]
    frame #3: 0x000000010d33e824 Electron Framework`electron::api::Notification::Close(this=0x0000012400186f60) at [electron_api_notification.cc:172](http://electron_api_notification.cc:172/):5 [opt]
    frame #4: 0x000000010d340864 Electron Framework`base::RepeatingCallback<void (electron::api::Notification*)>::Run(this=0x000000016fdfb5f8, args=0x000000016fdfb5d0) const & at callback.h:344:12 [opt] [inlined]
    frame #5: 0x000000010d340834 Electron Framework`gin::internal::Invoker<std::__Cr::integer_sequence<unsigned long, 0ul>, electron::api::Notification*>::DispatchToCallback(this=<unavailable>, callback=RepeatingCallback<void (electron::api::Notification *)> @ 0x000000016fdfb5f8) at function_template.h:232:14 [opt] [inlined]
    frame #6: 0x000000010d340834 Electron Framework`gin::internal::Dispatcher<void (electron::api::Notification*)>::DispatchToCallbackImpl(args=0x000000016fdfb648) at function_template.h:264:15 [opt]
    frame #7: 0x000000010d34066c Electron Framework`gin::internal::Dispatcher<void (electron::api::Notification*)>::DispatchToCallback(info=<unavailable>) at function_template.h:270:5 [opt]
    frame #8: 0x0000000157e0f6f8
    frame #9: 0x0000000157e0d710
    frame #10: 0x0000000150012acc
    frame #11: 0x0000000157e0b288
    frame #12: 0x0000000157e0aed4

The crash stack is as shown above.The specific reason is:

void Notification::Close() {
  if (notification_) {
    if (notification_->is_dismissed()) {
      notification_->Remove();
    } else {
      notification_->Dismiss(); ==> It will dispatch "close" event. If call notification.close in "close" event againt,
                                              ==> it run |notification_.reset()| in another close function.
    }
    notification_->set_delegate(nullptr);  ==> notification_ is invaild now. And crash.
    notification_.reset();
  }
}

Checklist

Release Notes

Notes: fix crash for Notification close

On the macOS platform, calling the `close` function again in the
`close` event of a Notification will cause a crash. The specific
reason is as follows: When the `close` function of a Notification
is called, the `dismiss` logic dispatches a "close" event. If the
`close` function is called again in the `close` event, it will
reset |notification_|, causing the weakptr to become
invalid. The first `close` function will continue to use this
invalid weakptr directly, thus triggering a crash.
@electron-cation electron-cation Bot added the new-pr 🌱 PR opened recently label May 13, 2026
@wujinli
Copy link
Copy Markdown
Contributor Author

wujinli commented May 14, 2026

@codebytere @deepak1556 @jkleinsc Could someone please review this? The problem and the solution are very clear.

@deepak1556 deepak1556 added semver/patch backwards-compatible bug fixes target/41-x-y PR should also be added to the "41-x-y" branch. target/42-x-y PR should also be added to the "42-x-y" branch. target/43-x-y PR should also be added to the "43-x-y" branch. labels May 15, 2026
@electron-cation electron-cation Bot removed the new-pr 🌱 PR opened recently label May 15, 2026
@deepak1556 deepak1556 requested a review from ckerr May 15, 2026 19:57
@ckerr ckerr merged commit 8ff3ef9 into electron:main May 15, 2026
88 checks passed
@release-clerk
Copy link
Copy Markdown

release-clerk Bot commented May 15, 2026

Release Notes Persisted

fix crash for Notification close

@trop
Copy link
Copy Markdown
Contributor

trop Bot commented May 15, 2026

I have automatically backported this PR to "43-x-y", please check out #51655

@trop trop Bot removed the target/43-x-y PR should also be added to the "43-x-y" branch. label May 15, 2026
@trop
Copy link
Copy Markdown
Contributor

trop Bot commented May 15, 2026

I have automatically backported this PR to "41-x-y", please check out #51656

@trop
Copy link
Copy Markdown
Contributor

trop Bot commented May 15, 2026

I have automatically backported this PR to "42-x-y", please check out #51657

@trop trop Bot added in-flight/41-x-y in-flight/42-x-y merged/41-x-y PR was merged to the "41-x-y" branch. and removed target/41-x-y PR should also be added to the "41-x-y" branch. target/42-x-y PR should also be added to the "42-x-y" branch. in-flight/41-x-y labels May 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in-flight/42-x-y in-flight/43-x-y merged/41-x-y PR was merged to the "41-x-y" branch. semver/patch backwards-compatible bug fixes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants