fix: renderer crash after IPC to a window.open() child with its own contextIsolation - #53541
Merged
Merged
Conversation
…ontextIsolation (#53535) A window.open() child of an opener with contextIsolation: false gets contextIsolation: true unless the handler overrides it, but its synchronous about:blank document starts with the opener's WebPreferences. Its Node.js environment is therefore created in the main world. Once the browser sends the child's own preferences, the observer and GetContext() pick the isolated world instead, so the first IPC message to the child created a context there and hit CHECK(!environments_.contains(render_frame)). Navigating such a child skipped the release of its environment for the same reason. Record the world of each frame's environment when it is created. While the environment exists, only that world is notified of context creation and release, and GetContext() returns the environment's context, so IPC reaches the preload that ran in it. (cherry picked from commit 5856ddc)
MarshallOfSound
added
backport
electron-cation
Bot
added
new-pr 🌱
3 tasks
MarshallOfSound
enabled auto-merge (squash)
September 4, 2026 19:45
VerteDinde
approved these changes
Sep 4, 2026
|
Release Notes Persisted
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #53535
See that PR for details. The only conflict was the include block in
shell/renderer/electron_render_frame_observer.cc(this branch does not have<utility>and<vector>there).Notes: Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process
window.open()child whosecontextIsolationdiffered from its opener's.