#53833: fix: crash when a node-integrated iframe is removed before its loop starts
Merged
Created: Sep 11, 2026, 7:05:00 PM
Merged: Sep 13, 2026, 1:52:30 AM
6 comments
Target: main
Fixes #53789.
#52964 gave each nodeIntegrationInSubFrames frame its own NodeBindings, whose dummy_uv_handle_ is only initialized by the task that first runs the frame's loop. A frame removed before that task runs (Meta Pixel's hidden form POST iframes hit this) destroyed a uv_async_t that never went through uv_async_init(), so uv_close() ran on uninitialized memory: a DCHECK in testing builds, heap corruption and an eventual renderer crash in release.
UvHandlevalue-initializes its handle, andreset()frees one that was never initialized (stillUV_UNKNOWN_HANDLE) instead of closing it.- New spec: the preload removes its own frame from a task queued while the frame's environment is created, which always lands before the loop's first run. It failed 21/21 without the fix (on an older nightly and on current main) and passes 10/10 with it.
Notes: Fixed a renderer crash when an iframe was removed right after loading with nodeIntegrationInSubFrames enabled and sandbox disabled, e.g. on pages that embed Meta Pixel.
Backports
Semver Impact
Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron