fix: emit render-process-gone outside the process-death notification#51900
Merged
Conversation
…forms Extends Chromium's Android/ChromeOS re-register carve-out in RendererStartupHelper::OnRenderProcessLaunched() to all platforms. The CHECK it replaces fails when a RenderProcessHost is re-initialized from inside the process-death notification - for example when an app reloads a WebContents synchronously from the 'render-process-gone' event - and brings down the browser process. Adds a regression spec that crashes a renderer and reloads it synchronously from the handler. Refs: crrev.com/c/7330559, crrev.com/c/7862000, crbug.com/512916518
Replaces the renderer_startup_helper.cc chromium patch from the previous commit: instead of relaxing the upstream CHECK, defer the 'render-process-gone' emit by one task so app code can no longer re-enter RenderProcessHostImpl::Init() from inside the process-death observer loop. Addresses review feedback that the CHECK should stay intact.
jkleinsc
approved these changes
Jun 8, 2026
|
Release Notes Persisted
|
This was referenced Jun 8, 2026
Contributor
|
I have automatically backported this PR to "42-x-y", please check out #51916 |
Contributor
|
I have automatically backported this PR to "41-x-y", please check out #51917 |
Contributor
|
I have automatically backported this PR to "43-x-y", please check out #51918 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of Change
Fixes a browser-process crash (
CHECKfailure inextensions::RendererStartupHelper::OnRenderProcessLaunched, surfacing asEXC_BREAKPOINTon macOS /EXCEPTION_BREAKPOINTon Windows on theCrBrowserMainthread) that occurs when an app reacts synchronously to therender-process-goneevent, most commonly by callingwebContents.reload()from the handler.render-process-gonewas emitted synchronously fromWebContents::PrimaryMainFrameRenderProcessGone, which is invoked whileRenderProcessHostImpl::ProcessDied()is still iterating the host's observer list. A reload (or any navigation) from the handler re-entersRenderProcessHostImpl::Init()from inside that loop; the resultingOnRenderProcessHostCreated()dispatch is ignored byRendererStartupHelperbecause the stale registration from the previous renderer is still present, the helper then untracks the process when its ownRenderProcessExited()runs, and when the relaunched process finishes launching,OnRenderProcessLaunched()finds no registration and theCHECKbrings down the browser process.Per review feedback, this no longer touches the upstream
CHECK(originally apatches/chromiumchange). Instead, therender-process-goneemit is deferred by one task, so the process-death notification fully unwinds before app code can react — coveringreload(),loadURL(), window recreation, and any other synchronous reaction. Chromium relaxed the sameCHECKfor this race on Android (https://crrev.com/c/7330559) and ChromeOS (https://crrev.com/c/7862000, https://crbug.com/512916518); extending that to desktop platforms will be pursued upstream separately, since a content-internal path to the same re-entrancy exists that embedder-side deferral cannot reach.Two intentional behavior notes for review:
exitCodeis captured at observer time, so the reported details are unchanged.WebContentsis destroyed within that one-task window, the event is not emitted (the JS wrapper is gone;destroyedfires as usual).Verified locally on macOS (arm64) with the
CHECKintact: a standalone repro (synchronousreload()insiderender-process-gone+forcefullyCrashRenderer()) reliably crashes an unpatched build ofmainwithFATAL:extensions/browser/renderer_startup_helper.cc:285] Check failed: GetRenderer(host) != nullptr || !client->IsSameContext(...), and survives with the deferred emit (reload completes normally). The added regression spec exercises the same sequence.Checklist
npm testpassesRelease Notes
Notes: Fixed a browser process crash when calling
webContents.reload()or navigating synchronously from therender-process-goneevent; the event is now emitted after the renderer's teardown notification has completed.