From c4302ab58caf22c31694b5de831af5d67b737b5a Mon Sep 17 00:00:00 2001
From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com>
Date: Fri, 25 Apr 2025 18:01:41 +0200
Subject: [PATCH] fix: crash when renderer process crashes while webview is
 reloading (#46768)

WebView uses WebContentsViewChildFrame, which doesn't have a Focus impl
and triggers a fatal NOTREACHED.

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Jinli Wu <wujinli@bytedance.com>
---
 .../browser/api/electron_api_web_contents.cc  |  8 +++++++
 shell/browser/api/electron_api_web_contents.h |  1 +
 spec/webview-spec.ts                          | 22 +++++++++++++++++++
 3 files changed, 31 insertions(+)

diff --git a/shell/browser/api/electron_api_web_contents.cc b/shell/browser/api/electron_api_web_contents.cc
index 9a3405834253..1ca1efb084b3 100644
--- a/shell/browser/api/electron_api_web_contents.cc
+++ b/shell/browser/api/electron_api_web_contents.cc
@@ -4014,6 +4014,14 @@ void WebContents::ExitPictureInPicture() {
   PictureInPictureWindowManager::GetInstance()->ExitPictureInPicture();
 }
 
+bool WebContents::ShouldFocusPageAfterCrash(content::WebContents* source) {
+  // WebView uses WebContentsViewChildFrame, which doesn't have a Focus impl
+  // and triggers a fatal NOTREACHED.
+  if (is_guest())
+    return false;
+  return true;
+}
+
 void WebContents::DevToolsSaveToFile(const std::string& url,
                                      const std::string& content,
                                      bool save_as,
diff --git a/shell/browser/api/electron_api_web_contents.h b/shell/browser/api/electron_api_web_contents.h
index 30a2365bc0a9..6793733db951 100644
--- a/shell/browser/api/electron_api_web_contents.h
+++ b/shell/browser/api/electron_api_web_contents.h
@@ -710,6 +710,7 @@ class WebContents final : public ExclusiveAccessContext,
   content::PictureInPictureResult EnterPictureInPicture(
       content::WebContents* web_contents) override;
   void ExitPictureInPicture() override;
+  bool ShouldFocusPageAfterCrash(content::WebContents* source) override;
 
   // InspectableWebContentsDelegate:
   void DevToolsSaveToFile(const std::string& url,
diff --git a/spec/webview-spec.ts b/spec/webview-spec.ts
index dfc30937706e..23d07e32569d 100644
--- a/spec/webview-spec.ts
+++ b/spec/webview-spec.ts
@@ -1895,6 +1895,28 @@ describe('<webview> tag', function () {
 
         expect(channel).to.equal('onbeforeunload');
       });
+
+      it('does not crash when renderer process crashes', async function () {
+        // It takes more time to wait for the rendering process to crash
+        this.timeout(120000);
+        await loadWebView(w, {
+          nodeintegration: 'on',
+          webpreferences: 'contextIsolation=no',
+          src: blankPageUrl
+        });
+        // Create a crash in the rendering process of a webview
+        await w.executeJavaScript(`new Promise((resolve, reject) => {
+          webview.addEventListener('render-process-gone', (e) => resolve({...e}), {once: true})
+          webview.executeJavaScript('process.crash()', true)
+        })`);
+        // Reload the webview and the main process will not crash.
+        await w.executeJavaScript(`new Promise((resolve, reject) => {
+          webview.reload()
+          webview.addEventListener('did-finish-load', () => {
+            resolve()
+          })
+        })`);
+      });
     });
 
     describe('<webview>.goForward()', () => {