Electron Releases

Description of Change

Fixes five places where shell/ kept a raw pointer to a content::WebContents / NativeWindow that JS can destroy first. Each was a main-process use-after-free reachable from public API; details in the individual commits.

• webContents.debugger.attach() after webContents.destroy() — use WebContentsObserver::web_contents() instead of a cached pointer; now throws No target available.
• openDevTools() after the setDevToolsWebContents() target was destroyed — hold it as a WeakPtr, fall back to the built-in DevTools.
• Re-initialising a renderer process whose registering webContents was destroyed (process sharing) — pending_processes_ stores WeakPtr<WebContents>.
• webContents.destroy() while an HTTP auth login event is queued — bind a WeakPtr into the posted task and cancel the auth request if it's gone.
• hide()/show() on a modal child after parent.destroy() — NativeWindow::parent_ becomes WeakPtr<NativeWindow>.

Each has a regression spec (debugger, webContents ×2, BrowserWindow modal) or crash-case fixture (webcontents-destroy-shared-process).

Checklist

• PR description included
• npm test passes
• tests are changed or added
• PR release notes describe the change in a way relevant to app developers, and are capitalized, punctuated, and past tense.

Release Notes

Notes: Fixed crashes when a webContents or parent window is destroyed while other APIs still reference it.