CHECK(host_view) in InstallRootWindowBoundsCallback

Having problems with building or using CEF's C/C++ APIs? This forum is here to help. Please do not post bug reports or feature requests here.

CHECK(host_view) in InstallRootWindowBoundsCallback

Postby ndesktop » Sat Jun 14, 2025 7:22 am

Context (maybe useful): Windows 10 x64, debug; CEF 7151 modified.
I have an interception mechanism for new popups; in libcef/browser/chrome/views\chrome_child_window.cc there is something like
Code: Select all
  void OnWindowCreated(CefRefPtr<CefWindow> window) override {
    DCHECK(!window_);
    window_ = window;

    // Bind the container private implementation. This needs to be done
    // before window_->AddChildView, which triggers OnAfterCreated, and we need
    // the pointer to be decoded and bound before that.
    BindContainer();

    // Add the browser view. It will now have an associated Widget.
    window_->AddChildView(browser_view_);

    ShowWindow();
  }

(notice the BindContainer call, but this does nothing more than setting the widget HWND some binding properties).

In libcef/browser/native/browser_platform_delegate_native_aura.cc
Code: Select all
void CefBrowserPlatformDelegateNativeAura::InstallRootWindowBoundsCallback() {
  auto* host_view = GetHostView();
  CHECK(host_view);

  host_view->SetRootWindowBoundsCallback(base::BindRepeating(
      [](base::WeakPtr<CefBrowserPlatformDelegateNativeAura> self) {
        return self->RootWindowBoundsCallback();
      },
      weak_ptr_factory_.GetWeakPtr()));
}

I am hitting CHECK(host_view).

This is called from
Code: Select all
void CefBrowserPlatformDelegateNativeAura::RenderViewReady() {
  CefBrowserPlatformDelegateNative::RenderViewReady();

  // The RWHV should now exist for Alloy style browsers.
  InstallRootWindowBoundsCallback();
}

but looks like it is crashing (for me) with or without --use-alloy-style.

Now I don't exactly know the entire lifetime of the host_view (if skipping this CHECK, host_view is not nullptr after the initial CHECK).
What I wonder is other calls, such as SendKeyEvent, SendMouseClickEvent, SendMouseMoveEvent are checking if GetHostView() returns nullptr, and nullptr is a valid return value since GetHostView is
Code: Select all
content::RenderWidgetHostViewAura*
CefBrowserPlatformDelegateNativeAura::GetHostView() const {
  if (!web_contents_) {
    return nullptr;
  }
  return static_cast<content::RenderWidgetHostViewAura*>(
      web_contents_->GetRenderWidgetHostView());
}

otherwise I would imagine instead of if (web_contents_) would have been a CHECK(web_contents_).

As for myself, I am changing locally as
Code: Select all
void CefBrowserPlatformDelegateNativeAura::InstallRootWindowBoundsCallback() {
  auto* host_view = GetHostView();
- CHECK(host_view);
+ if (!host_view) {
+   return;
+ }

  host_view->SetRootWindowBoundsCallback(base::BindRepeating(
      [](base::WeakPtr<CefBrowserPlatformDelegateNativeAura> self) {
        return self->RootWindowBoundsCallback();
      },
      weak_ptr_factory_.GetWeakPtr()));
}


But I would like to understand if what I'm saying makes sense.
ndesktop
Master
 
Posts: 937
Joined: Thu Dec 03, 2015 10:10 am

Re: CHECK(host_view) in InstallRootWindowBoundsCallback

Postby misros » Mon Jun 16, 2025 2:11 pm

We are also seeing this same crash in "CefBrowserPlatformDelegateNativeAura::InstallRootWindowBoundsCallback()" on a windows based application that embeds a CEF browser inside a WPF window.
The crash is not seen in CEF v134 but after upgrading to CEF v137.0.8, we started seeing this crash.

-SM
misros
Techie
 
Posts: 18
Joined: Thu Jan 20, 2022 10:12 pm

Re: CHECK(host_view) in InstallRootWindowBoundsCallback

Postby ndesktop » Mon Jun 16, 2025 3:27 pm

misros wrote:We are also seeing this same crash in "CefBrowserPlatformDelegateNativeAura::InstallRootWindowBoundsCallback()" on a windows based application that embeds a CEF browser inside a WPF window.
The crash is not seen in CEF v134 but after upgrading to CEF v137.0.8, we started seeing this crash.

-SM

Yes, because InstallRootWindowBoundsCallback was added in faa85bf which is in 137.
ndesktop
Master
 
Posts: 937
Joined: Thu Dec 03, 2015 10:10 am

Re: CHECK(host_view) in InstallRootWindowBoundsCallback

Postby magreenblatt » Tue Jun 17, 2025 12:44 pm

@ndesktop Are you able to reproduce the crash with “cefclient --use-native”?

It would be interesting to know what timing/callstack leads to RenderWidgetHostViewAura creation, and how that differs from the timing/callstack for InstallRootWindowBoundsCallback.
magreenblatt
Site Admin
 
Posts: 13059
Joined: Fri May 29, 2009 6:57 pm

Re: CHECK(host_view) in InstallRootWindowBoundsCallback

Postby ndesktop » Tue Jun 17, 2025 1:11 pm

magreenblatt wrote:@ndesktop Are you able to reproduce the crash with “cefclient --use-native”?

It would be interesting to know what timing/callstack leads to RenderWidgetHostViewAura creation, and how that differs from the timing/callstack for InstallRootWindowBoundsCallback.

It's hard in my scenario, since I am scanning the URL for malware and this definitely introduces timing issues; also I am blocking the popup and reopening after the user confirmations, so the regular flow is *very* altered.
cefclient: I will try with both my modified version and with the stock version. Previous tests (with my modifications) did not reproduce.
ndesktop
Master
 
Posts: 937
Joined: Thu Dec 03, 2015 10:10 am

Re: CHECK(host_view) in InstallRootWindowBoundsCallback

Postby misros » Tue Jun 17, 2025 5:02 pm

Here's my callstack if it helps.
Attachments
CALLSTACK.jpg
CALLSTACK.jpg (122.15 KiB) Viewed 5453 times
misros
Techie
 
Posts: 18
Joined: Thu Jan 20, 2022 10:12 pm

Re: CHECK(host_view) in InstallRootWindowBoundsCallback

Postby ndesktop » Wed Jun 18, 2025 2:45 am

Looks like the CHECK(host_view), line 25, yes.
ndesktop
Master
 
Posts: 937
Joined: Thu Dec 03, 2015 10:10 am

Re: CHECK(host_view) in InstallRootWindowBoundsCallback

Postby ndesktop » Wed Jun 18, 2025 3:00 am

magreenblatt wrote:@ndesktop Are you able to reproduce the crash with “cefclient --use-native”?

It would be interesting to know what timing/callstack leads to RenderWidgetHostViewAura creation, and how that differs from the timing/callstack for InstallRootWindowBoundsCallback.

Unable to reproduce with both stock cefclient 137, nor my own. Will keep trying.
As a guess, I was able to reproduce in my custom app, under debug, with a lot of pdb loaded, and noticeably slower; while there were no currently symbol loading to freeze or disrupt the timing, it was slower by a factor of 10x comparing to release. In debug, in that scenario with a popup blocked and opene after the user consent, repro is 100%. As soon as I have something more significant than "host_view is nullptr", I'll follow up.
ndesktop
Master
 
Posts: 937
Joined: Thu Dec 03, 2015 10:10 am

Re: CHECK(host_view) in InstallRootWindowBoundsCallback

Postby misros » Wed Jun 18, 2025 9:59 am

I'm able to reproduce this crash in cefsimple by creating the CEF browser inside a dialog instead of a top level window with these changes:

In simple_app.cc make the following changes:
Code: Select all
void SimpleApp::OnContextInitialized() {
[...]
use_views = false; [b]// don't use views[/b]
#if defined(OS_WIN)
// window_info.SetAsPopup(nullptr, "cefsimple"); [b]//**comment this. we are going to embed  CEF inside of a dialog as a child[/b]
s_CreateDialog();
window_info.SetAsChild(g_hDialog, CefRect(10,10,200,100));
#endif
[..]
}

----
//rest of the code below is to create the modeless dialog
Code: Select all
static HWND g_hDialog = nullptr;
INT_PTR CALLBACK DialogProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
    switch (message)
    {
    case WM_INITDIALOG:
        g_hDialog = hDlg;
        return TRUE;
    case WM_COMMAND:
        if (LOWORD(wParam) == IDOK)
        {
            DestroyWindow(hDlg);
            return TRUE;
        }
        break;

    case WM_CLOSE:
        DestroyWindow(hDlg);
        return TRUE;

    case WM_DESTROY:
        PostQuitMessage(0);
        return TRUE;
    }
    return FALSE;
}
static void s_CreateDialog()
{

    // Define dialog template in memory
    WORD dlgTemplate[1024];
    ZeroMemory(dlgTemplate, sizeof(dlgTemplate));

    DLGTEMPLATE* pDlg = (DLGTEMPLATE*)dlgTemplate;
    pDlg->style = WS_POPUP | WS_CAPTION | WS_SYSMENU | WS_VISIBLE | DS_SETFONT;
    pDlg->dwExtendedStyle = 0;
    pDlg->cdit = 2;
    pDlg->x = 10; pDlg->y = 10;
    pDlg->cx = 200; pDlg->cy = 100;

    WORD* p = (WORD*)(pDlg + 1);

    *p++ = 0;  // No menu
    *p++ = 0;  // Predefined dialog class
    wcscpy((wchar_t*)p, L"Runtime Modeless Dialog");
    p += wcslen(L"Runtime Modeless Dialog") + 1;

    *p++ = 8;  // Font size
    wcscpy((wchar_t*)p, L"MS Shell Dlg");
    p += wcslen(L"MS Shell Dlg") + 1;

    // DWORD alignment
    p = (WORD*)(((ULONG_PTR)p + 3) & ~3);

    // Static text control
    DLGITEMTEMPLATE* item1 = (DLGITEMTEMPLATE*)p;
    item1->x = 10; item1->y = 10;
    item1->cx = 180; item1->cy = 10;
    item1->id = 1000;
    item1->style = WS_CHILD | WS_VISIBLE;

    p = (WORD*)(item1 + 1);
    *p++ = 0xFFFF; *p++ = 0x0082; // Static
    wcscpy((wchar_t*)p, L"Modeless dialog created at runtime.");
    p += wcslen(L"Modeless dialog created at runtime.") + 1;
    *p++ = 0;

    p = (WORD*)(((ULONG_PTR)p + 3) & ~3);

    // OK Button
    DLGITEMTEMPLATE* item2 = (DLGITEMTEMPLATE*)p;
    item2->x = 75; item2->y = 40;
    item2->cx = 50; item2->cy = 14;
    item2->id = IDOK;
    item2->style = WS_CHILD | WS_VISIBLE | BS_DEFPUSHBUTTON;

    p = (WORD*)(item2 + 1);
    *p++ = 0xFFFF; *p++ = 0x0080; // Button
    wcscpy((wchar_t*)p, L"OK");
    p += wcslen(L"OK") + 1;
    *p++ = 0;

    // Create modeless dialog
    g_hDialog = CreateDialogIndirectParam(
        nullptr,
        (LPCDLGTEMPLATE)dlgTemplate,
        NULL,
        DialogProc,
        0
    );
}
misros
Techie
 
Posts: 18
Joined: Thu Jan 20, 2022 10:12 pm

Re: CHECK(host_view) in InstallRootWindowBoundsCallback

Postby magreenblatt » Wed Jun 18, 2025 11:06 am

I'm able to reproduce this crash in cefsimple by creating the CEF browser inside a dialog instead of a top level window with these changes

This is very helpful. Please create a new issue and include your reproduction steps and a link to this forum thread.
magreenblatt
Site Admin
 
Posts: 13059
Joined: Fri May 29, 2009 6:57 pm

Next

Return to Support Forum

Who is online

Users browsing this forum: No registered users and 82 guests