electron/shell
trop[bot] 94bc0ec88c
fix: prevent use-after-free in PowerMonitor via dangling OS callbacks (#50087)
PowerMonitor registered OS-level callbacks (HWND UserData and
WTS/suspend notifications on Windows, shutdown handler and lock-screen
observer on macOS) but never cleaned them up in its destructor. The JS
layer also only held the native object in a closure-local variable,
allowing GC to reclaim it while those registrations still referenced
freed memory.

Retain the native PowerMonitor at module level in power-monitor.ts so
it cannot be garbage-collected. Add DestroyPlatformSpecificMonitors()
to properly tear down OS registrations on destruction: on Windows,
unregister WTS and suspend notifications, clear GWLP_USERDATA, and
destroy the HWND; on macOS, remove the emitter from the global
MacLockMonitor and reset the Browser shutdown handler.

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
2026-03-05 15:24:12 -05:00
..
app chore: bump chromium to 146.0.7666.0 (41-x-y) (#49543) 2026-02-17 16:19:16 -05:00
browser fix: prevent use-after-free in PowerMonitor via dangling OS callbacks (#50087) 2026-03-05 15:24:12 -05:00
common fix: use proper quoting for exe paths and args on Windows (#50076) 2026-03-04 13:37:50 -06:00
renderer fix: use destination context when wrapping VideoFrame in contextBridge (#50023) 2026-03-03 09:15:37 -05:00
services/node feat: enable WASM trap handlers in all Node.js processes (#49839) 2026-02-18 13:22:36 -05:00
utility fix: broken OOP window.print() on macOS/Linux (#45214) 2025-01-20 10:23:44 +01:00