Skip to content

Using contentView.addChildView with a closed WebContentsView results in EXCEPTION_ACCESS_VIOLATION crash #47074

New issue
New issue
Closed
Bug
#47099
Closed
Using contentView.addChildView with a closed WebContentsView results in EXCEPTION_ACCESS_VIOLATION crash#47074
Bug
#47099
Assignees
codebytere
Labels
36-x-ybug 🪲component/WebContentsViewcomponent/typescriptcrash 💥has-repro-gistIssue can be reproduced with code at https://gist.github.com/platform/windows
@nikitakot

Description

@nikitakot
nikitakot
opened on May 13, 2025
Contributor

Preflight Checklist

  • I have read the Contributing Guidelines for this project.
    I agree to follow the Code of Conduct that this project adheres to.
    I have searched the issue tracker for a bug report that matches the one I want to file, without success.

Electron Version

36.2.0

What operating system(s) are you using?

Windows

Operating System Version

Windows 11 Pro Version 24H2

What arch are you using?

x64

Last Known Working Electron version

No response

Expected Behavior

Electron does not crash but error is thrown.
For typescript types - WebContentsView.webContents property should be optional. When webContents is destroyed the webContents becomes undefined, however WebContentsView does not reflect that.

Actual Behavior

Electron crashes with the following stack:

Received fatal exception EXCEPTION_ACCESS_VIOLATION
cppgc::internal::PersistentRegion::IsCreationThread [0x009F7DDB+174651]
cppgc::internal::PersistentRegion::IsCreationThread [0x009FBE61+191169]
cppgc::internal::PersistentRegion::IsCreationThread [0x009FBB79+190425]
cppgc::internal::PersistentRegion::IsCreationThread [0x009FB977+189911]
cppgc::internal::PersistentRegion::IsCreationThread [0x009FB89E+189694]
v8::internal::compiler::CompilationDependencies::FieldTypeDependencyOffTheRecord [0x03E802F6+1996774]
v8::internal::compiler::CompilationDependencies::FieldTypeDependencyOffTheRecord [0x03E7EE6A+1991514]
v8::internal::compiler::CompilationDependencies::FieldTypeDependencyOffTheRecord [0x03E7EE6A+1991514]
v8::internal::compiler::CompilationDependencies::FieldTypeDependencyOffTheRecord [0x03E7EE6A+1991514]
v8::internal::compiler::CompilationDependencies::FieldTypeDependencyOffTheRecord [0x03E7D1B9+1984169]
v8::internal::compiler::CompilationDependencies::FieldTypeDependencyOffTheRecord [0x03E7CFE1+1983697]
v8::internal::ThreadIsolation::StartOfJitAllocationAt [0x039D939C+77052]
v8::Function::Call [0x0399EC5D+397]
v8::Function::Call [0x0153DEDE+46]
node::SetCppgcReference [0x00BDFFF6+57622]
uv_timer_get_due_in [0x027C5306+246]
uv_run [0x027C22CE+1054]
node::loader::ModuleWrap::SelfSize [0x00AD5849+11209]
v8::internal::compiler::CompilationDependencies::FieldTypeDependencyOffTheRecord [0x0405B093+3941763]
Cr_z_crc32 [0x0416CFB9+859145]
v8::internal::compiler::CompilationDependencies::FieldTypeDependencyOffTheRecord [0x0404E98F+3890815]
uv_os_getpid [0x022717A2+4818]
GetHandleVerifier [0x02800380+76384]
uv_os_getpid [0x0229A69D+172493]
llhttp_get_errno [0x01962459+82681]
llhttp_get_errno [0x01963CAE+88910]
llhttp_get_errno [0x0195FD7D+72733]
v8_inspector::V8DebuggerId::V8DebuggerId [0x00E76AF9+435705]
v8_inspector::V8DebuggerId::V8DebuggerId [0x00E77B55+439893]
v8_inspector::V8DebuggerId::V8DebuggerId [0x00E77A2D+439597]
v8_inspector::V8DebuggerId::V8DebuggerId [0x00E7646F+434031]
v8_inspector::V8DebuggerId::V8DebuggerId [0x00E765E1+434401]
v8::SourceLocation::SourceLocation [0x009724B5+57589]
v8::SourceLocation::SourceLocation [0x009721C1+56833]
DeleteAce [0x758E0DE7+151]
DeleteAce [0x758E0D96+70]
RtlUserFiberStart [0x771393B7+23]

Electron exited with code 3221225477.

Testcase Gist URL

https://gist.github.com/nikitakot/96ac070f7d7f835a2fa1f1249b878c9c

Additional Information

No response

Activity

nikitakot
added
bug 🪲
on May 13, 2025
nikitakot
added the
Bug
issue type on May 13, 2025
electron-issue-triage
added
36-x-y
has-repro-gistIssue can be reproduced with code at https://gist.github.com/
platform/windows
on May 13, 2025
github-project-automation
added this to 36-x-yon May 13, 2025
github-project-automation
moved this to 👀 Unsorted Items in 36-x-yon May 13, 2025
nikwen

nikwen commented on May 13, 2025

@nikwen
nikwen
on May 13, 2025
Member

Thanks for reporting!

So this looks like two separate issues:

  1. Adjust TypeScript types
  2. Fix crash

I've encountered the types issue before, too.

nikwen
added
crash 💥
component/typescript
component/WebContentsView
on May 13, 2025
codebytere
self-assigned this
on May 14, 2025
VerteDinde
moved this from 👀 Unsorted Items to 🛑 Blocks Stable in 36-x-yon May 14, 2025
StaZhu

StaZhu commented on May 15, 2025

@StaZhu
StaZhu
on May 15, 2025
Contributor

We hit this crash on Electron 35.2.0 too.

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x170
Exception code: 0xc0000005
Process uptime: 1420 seconds

#0 Thread 46180 [CrBrowserMain] (crashed)
 0  Electron.exe + 0x2c569c!base::operator==(base::raw_ptr<views::View,0> const&, views::View*) [D:\ws\rs_v35_1_0_14_tcs\src\base\allocator\partition_allocator\src\partition_alloc\pointers\raw_ptr.h : 894 + 0x0]
 
    Found by: inline record
 1  Electron.exe + 0x2c569c!base::operator==(views::View*, base::raw_ptr<views::View,0> const&) [D:\ws\rs_v35_1_0_14_tcs\src\base\allocator\partition_allocator\src\partition_alloc\pointers\raw_ptr.h : 904 + 0x0]
 
    Found by: inline record
 2  Electron.exe + 0x2c569c!electron::api::View::AddChildViewAt(gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>) [D:\ws\rs_v35_1_0_14_tcs\src\electron\shell\browser\api\electron_api_view.cc : 232 + 0x0]
    rax = 0x0000146c00470400   rdx = 0x0000000000000000
    rcx = 0x0000000000000000   rbx = 0x0000000000000000
    rsi = 0x000000e38c5fd100   rdi = 0x0000146c01d0bb20
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd030
     r8 = 0x000000e38c5fd110    r9 = 0x000000e38c5fd110
    r10 = 0x00000ffef1672ac6   r11 = 0x0000000000000040
    r12 = 0x0000146c00288180   r13 = 0xfffffffc00000000
    r14 = 0x0000146c020259e0   r15 = 0x0000146c00289ff0
    rip = 0x00007ff78b39569c
    Found by: given as instruction pointer in context
 3  Electron.exe + 0x4c8683d!gin::ConvertToV8(v8::Isolate*, v8::Local<v8::Value> const&) [D:\ws\rs_v35_1_0_14_tcs\src\gin\converter.h : 327 + 0x12]
 
    Found by: inline record
 4  Electron.exe + 0x4c8683d!gin::TryConvertToV8(v8::Isolate*, v8::Local<v8::Value> const&, v8::Local<v8::Value>*) [D:\ws\rs_v35_1_0_14_tcs\src\gin\converter.h : 337 + 0x12]
 
    Found by: inline record
 5  Electron.exe + 0x4c8683e!gin::Arguments::Return<v8::Local<v8::Value> >(v8::Local<v8::Value> const&) [D:\ws\rs_v35_1_0_14_tcs\src\gin\arguments.h : 85 + 0x13]
    rax = 0x0000146c00470400   rdx = 0x0000000000000000
    rcx = 0x0000000000000000   rbx = 0x0000000000000000
    rsi = 0x000000e38c5fd100   rdi = 0x0000146c01d0bb20
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd040
     r8 = 0x000000e38c5fd110    r9 = 0x000000e38c5fd110
    r10 = 0x00000ffef1672ac6   r11 = 0x0000000000000040
    r12 = 0x0000146c00288180   r13 = 0xfffffffc00000000
    r14 = 0x0000146c020259e0   r15 = 0x0000146c00289ff0
    rip = 0x00007ff78fd5683e
    Found by: simulating a return from leaf function
 6  Electron.exe + 0x22d26b!base::internal::DecayedFunctorTraits<v8::Local<v8::Value> (electron::api::App::*)()>::Invoke(v8::Local<v8::Value> (electron::api::App::*)(), electron::api::App*&&) [D:\ws\rs_v35_1_0_14_tcs\src\base\functional\bind_internal.h : 728 + 0xb]
 
    Found by: inline record
 7  Electron.exe + 0x22d26b!base::internal::InvokeHelper<0,base::internal::FunctorTraits<v8::Local<v8::Value> (electron::api::App::*const &)()>,v8::Local<v8::Value> >::MakeItSo(v8::Local<v8::Value> (electron::api::App::* const&)(), std::__Cr::tuple<> const&, electron::api::App*&&) [D:\ws\rs_v35_1_0_14_tcs\src\base\functional\bind_internal.h : 920 + 0xb]
 
    Found by: inline record
 8  Electron.exe + 0x22d26b!base::internal::Invoker<base::internal::FunctorTraits<v8::Local<v8::Value> (electron::api::App::*const &)()>,base::internal::BindState<1,1,0,v8::Local<v8::Value> (electron::api::App::*)()>,v8::Local<v8::Value> (electron::api::App *)>::RunImpl(v8::Local<v8::Value> (electron::api::App::* const&)(), std::__Cr::tuple<> const&, std::__Cr::integer_sequence<unsigned long long>, electron::api::App*&&) [D:\ws\rs_v35_1_0_14_tcs\src\base\functional\bind_internal.h : 1057 + 0xb]
 
    Found by: inline record
 9  Electron.exe + 0x22d26c!base::internal::Invoker<base::internal::FunctorTraits<v8::Local<v8::Value> (electron::api::App::*const &)()>,base::internal::BindState<1,1,0,v8::Local<v8::Value> (electron::api::App::*)()>,v8::Local<v8::Value> (electron::api::App *)>::Run(base::internal::BindStateBase*, electron::api::App*) [D:\ws\rs_v35_1_0_14_tcs\src\base\functional\bind_internal.h : 977 + 0xc]
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd060
    rip = 0x00007ff78b2fd26c
    Found by: stack scanning
10  Electron.exe + 0x248287!base::RepeatingCallback<v8::Local<v8::Value> (electron::api::BaseWindow *)>::~RepeatingCallback() [D:\ws\rs_v35_1_0_14_tcs\src\base\functional\callback.h : 301 + 0x4]
 
    Found by: inline record
11  Electron.exe + 0x248288!gin_helper::Invoker<std::__Cr::integer_sequence<unsigned long long,0>,electron::api::BaseWindow *>::DispatchToCallback<v8::Local<v8::Value> >(base::RepeatingCallback<v8::Local<v8::Value> (electron::api::BaseWindow *)>) [D:\ws\rs_v35_1_0_14_tcs\src\electron\shell\common\gin_helper\function_template.h : 277 + 0x5]
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd090
    rip = 0x00007ff78b318288
    Found by: stack scanning
12  Electron.exe + 0x2ca6de!base::internal::DecayedFunctorTraits<void (electron::api::View::*)(gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>::Invoke(void (electron::api::View::*)(gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>), electron::api::View*&&, gin::Handle<electron::api::View>&&, std::__Cr::optional<unsigned long long>&&) [D:\ws\rs_v35_1_0_14_tcs\src\base\functional\bind_internal.h : 728 + 0x8]
 
    Found by: inline record
13  Electron.exe + 0x2ca6de!base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (electron::api::View::*const &)(gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>,void>::MakeItSo(void (electron::api::View::* const&)(gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>), std::__Cr::tuple<> const&, electron::api::View*&&, gin::Handle<electron::api::View>&&, std::__Cr::optional<unsigned long long>&&) [D:\ws\rs_v35_1_0_14_tcs\src\base\functional\bind_internal.h : 920 + 0x8]
 
    Found by: inline record
14  Electron.exe + 0x2ca6de!base::internal::Invoker<base::internal::FunctorTraits<void (electron::api::View::*const &)(gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>,base::internal::BindState<1,1,0,void (electron::api::View::*)(gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>,void (electron::api::View *, gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>::RunImpl(void (electron::api::View::* const&)(gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>), std::__Cr::tuple<> const&, std::__Cr::integer_sequence<unsigned long long>, electron::api::View*&&, gin::Handle<electron::api::View>&&, std::__Cr::optional<unsigned long long>&&) [D:\ws\rs_v35_1_0_14_tcs\src\base\functional\bind_internal.h : 1057 + 0x8]
 
    Found by: inline record
15  Electron.exe + 0x2ca6df!base::internal::Invoker<base::internal::FunctorTraits<void (electron::api::View::*const &)(gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>,base::internal::BindState<1,1,0,void (electron::api::View::*)(gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>,void (electron::api::View *, gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>::Run(base::internal::BindStateBase*, electron::api::View*, gin::Handle<electron::api::View>&&, std::__Cr::optional<unsigned long long>&&) [D:\ws\rs_v35_1_0_14_tcs\src\base\functional\bind_internal.h : 977 + 0x9]
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd0e0
    rip = 0x00007ff78b39a6df
    Found by: stack scanning
16  Electron.exe + 0x73a43ee!gin::Arguments::GetHolderCreationContext() const [D:\ws\rs_v35_1_0_14_tcs\src\gin\arguments.cc : 58 + 0xb]
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd100
    rip = 0x00007ff7924743ee
    Found by: stack scanning
17  Electron.exe + 0x2ca3cf!base::RepeatingCallback<void (electron::api::View *, gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>::Run(electron::api::View*, gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>) const [D:\ws\rs_v35_1_0_14_tcs\src\base\functional\callback.h : 344 + 0x8]
 
    Found by: inline record
18  Electron.exe + 0x2ca3d0!gin_helper::Invoker<std::__Cr::integer_sequence<unsigned long long,0,1,2>,electron::api::View *,gin::Handle<electron::api::View>,std::__Cr::optional<unsigned long long> >::DispatchToCallback(base::RepeatingCallback<void (electron::api::View *, gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>) [D:\ws\rs_v35_1_0_14_tcs\src\electron\shell\common\gin_helper\function_template.h : 286 + 0x9]
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd130
    rip = 0x00007ff78b39a3d0
    Found by: stack scanning
19  Electron.exe + 0x2ca66f!base::internal::RawPtrBackupRefImpl<0,0>::WrapRawPtr(electron::api::View*) [D:\ws\rs_v35_1_0_14_tcs\src\base\allocator\partition_allocator\src\partition_alloc\pointers\raw_ptr_backup_ref_impl.h : 165 + 0x7]
 
    Found by: inline record
20  Electron.exe + 0x2ca66f!base::raw_ptr<electron::api::View,0>::raw_ptr(electron::api::View*) [D:\ws\rs_v35_1_0_14_tcs\src\base\allocator\partition_allocator\src\partition_alloc\pointers\raw_ptr.h : 523 + 0x7]
 
    Found by: inline record
21  Electron.exe + 0x2ca66f!gin::Handle<electron::api::View>::Handle(v8::Local<v8::Value>, electron::api::View*) [D:\ws\rs_v35_1_0_14_tcs\src\gin\handle.h : 24 + 0x7]
 
    Found by: inline record
22  Electron.exe + 0x2ca66f!gin::Converter<gin::Handle<electron::api::View>,void>::FromV8(v8::Isolate*, v8::Local<v8::Value>, gin::Handle<electron::api::View>*) [D:\ws\rs_v35_1_0_14_tcs\src\gin\handle.h : 55 + 0x7]
 
    Found by: inline record
23  Electron.exe + 0x2ca66f!gin::ConvertFromV8(v8::Isolate*, v8::Local<v8::Value>, gin::Handle<electron::api::View>*) [D:\ws\rs_v35_1_0_14_tcs\src\gin\converter.h : 363 + 0x7]
 
    Found by: inline record
24  Electron.exe + 0x2ca670!gin::Arguments::GetNext<gin::Handle<electron::api::View> >(gin::Handle<electron::api::View>*) [D:\ws\rs_v35_1_0_14_tcs\src\gin\arguments.h : 50 + 0x8]
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd140
    rip = 0x00007ff78b39a670
    Found by: stack scanning
25  Electron.exe + 0x2ca177!gin_helper::Dispatcher<void (electron::api::View *, gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>::DispatchToCallbackImpl(gin::Arguments*) [D:\ws\rs_v35_1_0_14_tcs\src\electron\shell\common\gin_helper\function_template.h : 312 + 0xd]
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd1e0
    rip = 0x00007ff78b39a177
    Found by: stack scanning
26  Electron.exe + 0x432d8f0!Builtins_CallApiCallbackGeneric + 0xb0
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd1f0
    rip = 0x00007ff78f3fd8f0
    Found by: stack scanning
27  Electron.exe + 0x2ca064!gin_helper::Dispatcher<void (electron::api::View *, gin::Handle<electron::api::View>, std::__Cr::optional<unsigned long long>)>::DispatchToCallback(v8::FunctionCallbackInfo<v8::Value> const&) [D:\ws\rs_v35_1_0_14_tcs\src\electron\shell\common\gin_helper\function_template.h : 318 + 0x8]
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd290
    rip = 0x00007ff78b39a064
    Found by: stack scanning
28  Electron.exe + 0x432d8f0!Builtins_CallApiCallbackGeneric + 0xb0
    rbp = 0x000000e38c5fd328   rsp = 0x000000e38c5fd2e0
    rip = 0x00007ff78f3fd8f0
    Found by: stack scanning
29  Electron.exe + 0x432baf5!Builtins_InterpreterEntryTrampoline + 0x135
    rbp = 0x000000e38c5fd3c8   rsp = 0x000000e38c5fd338
    rip = 0x00007ff78f3fbaf5
    Found by: stack scanning
30  Electron.exe + 0x432baf5!Builtins_InterpreterEntryTrampoline + 0x135
    rbp = 0x000000e38c5fd440   rsp = 0x000000e38c5fd3d8
    rip = 0x00007ff78f3fbaf5
    Found by: stack scanning
31  Electron.exe + 0x4451f4f!Builtins_PromiseConstructor + 0x80f
    rbp = 0x000000e38c5fd4b0   rsp = 0x000000e38c5fd450
    rip = 0x00007ff78f521f4f
    Found by: stack scanning
32  Electron.exe + 0x432c433!Builtins_InterpreterPushArgsThenFastConstructFunction + 0x2b3
    rbp = 0x000000e38c5fd4e8   rsp = 0x000000e38c5fd4c0
    rip = 0x00007ff78f3fc433
    Found by: stack scanning
33  Electron.exe + 0x44d8fa7!Builtins_ConstructHandler + 0x367
    rbp = 0x000000e38c5fd540   rsp = 0x000000e38c5fd4f8
    rip = 0x00007ff78f5a8fa7
    Found by: stack scanning
34  Electron.exe + 0x44de50c!Builtins_CreateClosureHandler + 0x8c
    rbp = 0x000000e38c5fd540   rsp = 0x000000e38c5fd520
    rip = 0x00007ff78f5ae50c
    Found by: stack scanning
35  Electron.exe + 0x432baf5!Builtins_InterpreterEntryTrampoline + 0x135
    rbp = 0x000000e38c5fd5b0   rsp = 0x000000e38c5fd550
    rip = 0x00007ff78f3fbaf5
    Found by: stack scanning
36  Electron.exe + 0x445376a!Builtins_PromiseFulfillReactionJob + 0x2a
    rbp = 0x000000e38c5fd5e8   rsp = 0x000000e38c5fd5c0
    rip = 0x00007ff78f52376a
    Found by: stack scanning
37  Electron.exe + 0x435c93b!Builtins_RunMicrotasks + 0x2fb
    rbp = 0x000000e38c5fd658   rsp = 0x000000e38c5fd5f8
    rip = 0x00007ff78f42c93b
    Found by: stack scanning
38  Electron.exe + 0x43294bf!Builtins_JSRunMicrotasksEntry + 0xff
    rbp = 0x000000e38c5fd780   rsp = 0x000000e38c5fd668
    rip = 0x00007ff78f3f94bf
    Found by: stack scanning
39  Electron.exe + 0x3c66cdc!v8::internal::GeneratedCode<unsigned long long,unsigned long long,v8::internal::MicrotaskQueue *>::Call(unsigned long long, v8::internal::MicrotaskQueue*) [D:\ws\rs_v35_1_0_14_tcs\src\v8\src\execution\simulator.h : 191 + 0x2]
 
    Found by: inline record
40  Electron.exe + 0x3c66cdd!v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) [D:\ws\rs_v35_1_0_14_tcs\src\v8\src\execution\execution.cc : 455 + 0x3]
    rsp = 0x000000e38c5fd790   rip = 0x00007ff78ed36cdd
    Found by: stack scanning
41  Electron.exe + 0x49ff12!node::async_context_frame::set(v8::Isolate*, v8::Local<v8::Value>) [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\async_context_frame.cc : 41 + 0x7]
 
    Found by: inline record
42  Electron.exe + 0x49ff13!node::async_context_frame::exchange(v8::Isolate*, v8::Local<v8::Value>) [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\async_context_frame.cc : 53 + 0x8]
    rsp = 0x000000e38c5fd7b0   rip = 0x00007ff78b56ff13
    Found by: stack scanning
43  Electron.exe + 0x4960b6!node::InternalCallbackScope::Close::<lambda_1>::operator()() const [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\api\callback.cc : 121 + 0x9]
 
    Found by: inline record
44  Electron.exe + 0x4960b6!node::OnScopeLeaveImpl<`lambda at ..\..\third_party\electron_node\src\api\callback.cc:121:28'>::~OnScopeLeaveImpl() [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\util.h : 603 + 0x9]
 
    Found by: inline record
45  Electron.exe + 0x4960b7!node::InternalCallbackScope::Close() [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\api\callback.cc : 178 + 0xa]
    rsp = 0x000000e38c5fd800   rip = 0x00007ff78b5660b7
    Found by: stack scanning
46  Electron.exe + 0xfbcaf9!v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) [D:\ws\rs_v35_1_0_14_tcs\src\v8\src\api\api.cc : 5612 + 0x1a]
    rsp = 0x000000e38c5fd850   rip = 0x00007ff78c08caf9
    Found by: stack scanning
47  Electron.exe + 0x4963bd!v8::PersistentBase<v8::Value>::Reset() [D:\ws\rs_v35_1_0_14_tcs\src\v8\include\v8-persistent-handle.h : 451 + 0x4]
 
    Found by: inline record
48  Electron.exe + 0x4963bd!v8::Global<v8::Value>::~Global() [D:\ws\rs_v35_1_0_14_tcs\src\v8\include\v8-persistent-handle.h : 383 + 0x4]
 
    Found by: inline record
49  Electron.exe + 0x4963bd!node::InternalCallbackScope::~InternalCallbackScope() [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\api\callback.cc : 101 + 0x4]
 
    Found by: inline record
50  Electron.exe + 0x4963be!node::InternalMakeCallback(node::Environment*, v8::Local<v8::Object>, v8::Local<v8::Object>, const v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\api\callback.cc : 241 + 0x5]
    rsp = 0x000000e38c5fd8a0   rip = 0x00007ff78b5663be
    Found by: stack scanning
51  Electron.exe + 0x101da81!v8::internal::(anonymous namespace)::InvokeWithTryCatch(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) [D:\ws\rs_v35_1_0_14_tcs\src\v8\src\execution\execution.cc : 497 + 0xe]
    rsp = 0x000000e38c5fd970   rip = 0x00007ff78c0eda81
    Found by: stack scanning
52  Electron.exe + 0x101dc7e!v8::internal::Execution::TryRunMicrotasks(v8::internal::Isolate*, v8::internal::MicrotaskQueue*) [D:\ws\rs_v35_1_0_14_tcs\src\v8\src\execution\execution.cc : 601 + 0xb]
    rsp = 0x000000e38c5fda00   rip = 0x00007ff78c0edc7e
    Found by: stack scanning
53  Electron.exe + 0x496b37!v8::Context::Scope::~Scope() [D:\ws\rs_v35_1_0_14_tcs\src\v8\include\v8-context.h : 388 + 0xf]
 
    Found by: inline record
54  Electron.exe + 0x496b38!node::InternalMakeCallback(v8::Isolate*, v8::Local<v8::Object>, v8::Local<v8::Function>, int, v8::Local<v8::Value>*, node::async_context, v8::Local<v8::Value>) [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\api\callback.cc : 315 + 0x10]
    rsp = 0x000000e38c5fda10   rip = 0x00007ff78b566b38
    Found by: stack scanning
55  Electron.exe + 0x3c772d8!v8::internal::MicrotaskQueue::RunMicrotasks(v8::internal::Isolate*) [D:\ws\rs_v35_1_0_14_tcs\src\v8\src\execution\microtask-queue.cc : 185 + 0x15]
 
    Found by: inline record
56  Electron.exe + 0x3c772d8!v8::internal::MicrotaskQueue::PerformCheckpointInternal(v8::Isolate*) [D:\ws\rs_v35_1_0_14_tcs\src\v8\src\execution\microtask-queue.cc : 129 + 0x15]
 
    Found by: inline record
57  Electron.exe + 0x3c772d9!v8::internal::MicrotaskQueue::PerformCheckpoint(v8::Isolate*) [D:\ws\rs_v35_1_0_14_tcs\src\v8\src\execution\microtask-queue.h : 48 + 0x16]
    rsp = 0x000000e38c5fda80   rip = 0x00007ff78ed472d9
    Found by: stack scanning
58  Electron.exe + 0x3be8a7!node::Environment::GetCurrent(v8::Isolate*) [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\env-inl.h : 192 + 0xa]
    rsp = 0x000000e38c5fdaa0   rip = 0x00007ff78b48e8a7
    Found by: stack scanning
59  Electron.exe + 0x49ff12!node::async_context_frame::set(v8::Isolate*, v8::Local<v8::Value>) [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\async_context_frame.cc : 41 + 0x7]
 
    Found by: inline record
60  Electron.exe + 0x49ff13!node::async_context_frame::exchange(v8::Isolate*, v8::Local<v8::Value>) [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\async_context_frame.cc : 53 + 0x8]
    rsp = 0x000000e38c5fdb30   rip = 0x00007ff78b56ff13
    Found by: stack scanning
61  Electron.exe + 0x496132!node::InternalCallbackScope::Close() [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\api\callback.cc : 147 + 0x1b]
    rsp = 0x000000e38c5fdb80   rip = 0x00007ff78b566132
    Found by: stack scanning
62  Electron.exe + 0x4966a9!node::MakeCallback(v8::Isolate*, v8::Local<v8::Object>, char const*, int, v8::Local<v8::Value>*, node::async_context) [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\api\callback.cc : 253 + 0x29]
    rsp = 0x000000e38c5fdbc0   rip = 0x00007ff78b5666a9
    Found by: stack scanning
63  Electron.exe + 0x495be5!node::CallbackScope::CallbackScope(node::Environment*, v8::Local<v8::Object>, node::async_context) [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\api\callback.cc : 33 + 0x9]
 
    Found by: inline record
64  Electron.exe + 0x495be6!node::CallbackScope::CallbackScope(v8::Isolate*, v8::Local<v8::Object>, node::async_context) [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\api\callback.cc : 24 + 0xa]
    rsp = 0x000000e38c5fdbe0   rip = 0x00007ff78b565be6
    Found by: stack scanning
65  Electron.exe + 0x9dabb5f!_tailMerge_winusb.dll + 0x2cc803
    rsp = 0x000000e38c5fdc00   rip = 0x00007ff794e7bb5f
    Found by: stack scanning
66  Electron.exe + 0x495b2f!node::InternalCallbackScope::~InternalCallbackScope() [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\api\callback.cc : 99 + 0x7]
 
    Found by: inline record
67  Electron.exe + 0x495b30!node::CallbackScope::~CallbackScope() [D:\ws\rs_v35_1_0_14_tcs\src\third_party\electron_node\src\api\callback.cc : 39 + 0x8]
    rsp = 0x000000e38c5fdc20   rip = 0x00007ff78b565b30
    Found by: stack scanning
68  Electron.exe + 0x9dabb5f!_tailMerge_winusb.dll + 0x2cc803
    rsp = 0x000000e38c5fdc28   rip = 0x00007ff794e7bb5f
    Found by: stack scanning
69  Electron.exe + 0x3e04d0!gin_helper::internal::CallMethodWithArgs(v8::Isolate*, v8::Local<v8::Object>, char const*, const base::span<v8::Local<v8::Value>,18446744073709551615,v8::Local<v8::Value> *>) [D:\ws\rs_v35_1_0_14_tcs\src\electron\shell\common\gin_helper\event_emitter_caller.cc : 43 + 0x1a]
    rsp = 0x000000e38c5fdc60   rip = 0x00007ff78b4b04d0
    Found by: stack scanning

Here is my fix that seems working and solve the problem:

# shell/browser/api/electron_api_view.cc

void View::AddChildViewAt(gin::Handle<View> child,
                          std::optional<size_t> maybe_index) {
  // TODO(nornagon): !view_ is only for supporting the weird case of
  // WebContentsView's view being deleted when the underlying WebContents is
  // destroyed (on non-Mac). We should fix that so that WebContentsView always
  // has a View, possibly a wrapper view around the underlying platform View.
  if (!view_)
    return;

  // This will CHECK and crash in View::AddChildViewAtImpl if not handled here.
  if (view_ == child->view()) {
    gin_helper::ErrorThrower(isolate()).ThrowError(
        "A view cannot be added as its own child");
    return;
  }

  size_t index =
      std::min(child_views_.size(), maybe_index.value_or(child_views_.size()));

  + if (!child->view()) {
  + gin_helper::ErrorThrower(isolate()).ThrowError(
  +     "Can't add a destroyed child view to a parent view");
  +  return;
  + }

  // If the child is already a child of this view, just reorder it.
  // This matches the behavior of View::AddChildViewAtImpl and
  // otherwise will CHECK if the same view is added multiple times.
  if (child->view()->parent() == view_) {
    ReorderChildView(child, index);
    return;
  }
  
  ...
StaZhu
mentioned this on May 15, 2025
codebytere
closed this as completedin #47099on Jun 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

36-x-ybug 🪲component/WebContentsViewcomponent/typescriptcrash 💥has-repro-gistIssue can be reproduced with code at https://gist.github.com/platform/windows

Type

Bug

Projects

Milestone

No milestone

Relationships

None yet

    Development

    Participants

    @codebytere@nikwen@nikitakot@StaZhu

    Issue actions
      Using contentView.addChildView with a closed WebContentsView results in EXCEPTION_ACCESS_VIOLATION crash · Issue #47074 · electron/electron