MarshallOfSound

#53535: fix: renderer crash after IPC to a window.open() child with its own contextIsolation

Merged
Created: Sep 4, 2026, 12:32:51 PM
Merged: Sep 4, 2026, 1:51:21 PM
8 comments
Target: main

Description of Change

Fixes #53521.

A window.open() child of an opener with contextIsolation: false gets contextIsolation: true unless the handler overrides it. Its synchronous about:blank document still starts with the opener's WebPreferences, so its Node.js environment is created in the main world. Once the browser sends the child's own preferences, the observer and GetContext() pick the isolated world instead.

  • The first IPC message to such a child created a context in the isolated world and hit CHECK(!environments_.contains(render_frame)). Before #52964 this created a second environment and ran the preload again.
  • Navigating such a child skipped the release of its environment for the same reason. That crashed before #52964 as well.
  • ElectronRendererClient now records the world of each frame's environment when it creates it. While the environment exists, only that world is notified of context creation and release (ShouldNotifyClient), and GetContext() returns the environment's context, so IPC reaches the preload that ran in it.
  • The sandboxed renderer client keeps its current behavior.
Build IPC to the child Child navigates
42.9.3 survives SIGSEGV
42.11.2 CHECK CHECK
this PR survives, preload receives the message survives

Checklist

  • PR description included
  • npm test passes
  • tests are added

Release Notes

Notes: Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's.

Backports

42-x-y
Merged
PR Number
#53541
Merged At
Sep 4, 2026, 3:43:46 PM
Released In
Not yet
Release Date
Not yet
43-x-y
Merged
PR Number
#53540
Merged At
Sep 4, 2026, 3:48:39 PM
Released In
Not yet
Release Date
Not yet
44-x-y
Merged
PR Number
#53539
Merged At
Sep 4, 2026, 3:47:31 PM
Released In
Not yet
Release Date
Not yet
45-x-y
Merged
PR Number
#53538
Merged At
Sep 4, 2026, 3:01:11 PM
Released In
Not yet
Release Date
Not yet

Semver Impact

Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.

Semantic Versioning helps users understand the impact of updates:

  • Major (X.y.z): Breaking changes that may require code modifications
  • Minor (x.Y.z): New features that maintain backward compatibility
  • Patch (x.y.Z): Bug fixes that don't change the API
  • None: Changes that don't affect using facing parts of Electron