#53535: fix: renderer crash after IPC to a window.open() child with its own contextIsolation
Merged
Created: Sep 4, 2026, 12:32:51 PM
Merged: Sep 4, 2026, 1:51:21 PM
8 comments
Target: main
Description of Change
Fixes #53521.
A window.open() child of an opener with contextIsolation: false gets contextIsolation: true unless the handler overrides it. Its synchronous about:blank document still starts with the opener's WebPreferences, so its Node.js environment is created in the main world. Once the browser sends the child's own preferences, the observer and GetContext() pick the isolated world instead.
- The first IPC message to such a child created a context in the isolated world and hit
CHECK(!environments_.contains(render_frame)). Before #52964 this created a second environment and ran the preload again. - Navigating such a child skipped the release of its environment for the same reason. That crashed before #52964 as well.
ElectronRendererClientnow records the world of each frame's environment when it creates it. While the environment exists, only that world is notified of context creation and release (ShouldNotifyClient), andGetContext()returns the environment's context, so IPC reaches the preload that ran in it.- The sandboxed renderer client keeps its current behavior.
| Build | IPC to the child | Child navigates |
|---|---|---|
| 42.9.3 | survives | SIGSEGV |
| 42.11.2 | CHECK | CHECK |
| this PR | survives, preload receives the message | survives |
Checklist
- PR description included
-
npm testpasses - tests are added
Release Notes
Notes: Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's.
Backports
Semver Impact
Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron