Fix RFHImpl::CancelPrerendering crash during WebContents teardown. [chromium/src : main]

0 views
Skip to first unread message

Gabriel Charette (Gerrit)

unread,
Jul 7, 2026, 1:30:25 PM (22 hours ago) Jul 7
to Gabriel Charette, Hiroki Nakagawa, android-bu...@system.gserviceaccount.com, Chromium LUCI CQ, chromium...@chromium.org, tburkar...@chromium.org, prerenderi...@chromium.org, gavin...@chromium.org, alexmo...@chromium.org, creis...@chromium.org, navigation...@chromium.org
Attention needed from Hiroki Nakagawa

Gabriel Charette voted and added 1 comment

Votes added by Gabriel Charette

Auto-Submit+1
Commit-Queue+1

1 comment

File content/browser/renderer_host/render_frame_host_impl.cc
Line 14690, Patchset 6: WebContents* web_contents = WebContents::FromRenderFrameHost(this);
if (web_contents && web_contents->IsBeingDestroyed()) {
return false;
}
Hiroki Nakagawa . unresolved

WebContents cannot be directly accessed in content/browser/renderer_host/. See the README here:
https://source.chromium.org/chromium/chromium/src/+/main:content/browser/renderer_host/README.md;l=85-89;drc=dd260a2e28e777cbfdf925ddef38db34c4d6b9d0

I ran out of time to find a workaround today, but I wanted to share this early so you're aware.

Gabriel Charette

How about this? Looks like we can get away with diamond inheritance to get the existing property through the delegate.

Open in Gerrit

Related details

Attention is currently required from:
  • Hiroki Nakagawa
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: Ifb97cd7dfa43b58daffa14fb72b4582f3d78ea69
Gerrit-Change-Number: 8026212
Gerrit-PatchSet: 12
Gerrit-Owner: Gabriel Charette <g...@chromium.org>
Gerrit-Reviewer: Gabriel Charette <g...@chromium.org>
Gerrit-Reviewer: Hiroki Nakagawa <nhi...@chromium.org>
Gerrit-Attention: Hiroki Nakagawa <nhi...@chromium.org>
Gerrit-Comment-Date: Tue, 07 Jul 2026 17:30:17 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Comment-In-Reply-To: Hiroki Nakagawa <nhi...@chromium.org>
satisfied_requirement
unsatisfied_requirement
open
diffy

Hiroki Nakagawa (Gerrit)

unread,
9:43 AM (1 hour ago) 9:43 AM
to Gabriel Charette, android-bu...@system.gserviceaccount.com, Chromium LUCI CQ, chromium...@chromium.org, tburkar...@chromium.org, prerenderi...@chromium.org, gavin...@chromium.org, alexmo...@chromium.org, creis...@chromium.org, navigation...@chromium.org
Attention needed from Gabriel Charette

Hiroki Nakagawa voted and added 2 comments

Votes added by Hiroki Nakagawa

Code-Review+1

2 comments

Patchset-level comments
File-level comment, Patchset 13 (Latest):
Hiroki Nakagawa . resolved

LGTM, thank you!

File content/browser/renderer_host/render_frame_host_impl.cc
Line 14690, Patchset 6: WebContents* web_contents = WebContents::FromRenderFrameHost(this);
if (web_contents && web_contents->IsBeingDestroyed()) {
return false;
}
Hiroki Nakagawa . resolved

WebContents cannot be directly accessed in content/browser/renderer_host/. See the README here:
https://source.chromium.org/chromium/chromium/src/+/main:content/browser/renderer_host/README.md;l=85-89;drc=dd260a2e28e777cbfdf925ddef38db34c4d6b9d0

I ran out of time to find a workaround today, but I wanted to share this early so you're aware.

Gabriel Charette

How about this? Looks like we can get away with diamond inheritance to get the existing property through the delegate.

Hiroki Nakagawa

Looks great!

Open in Gerrit

Related details

Attention is currently required from:
  • Gabriel Charette
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement satisfiedCode-Review
    • requirement satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: Ifb97cd7dfa43b58daffa14fb72b4582f3d78ea69
    Gerrit-Change-Number: 8026212
    Gerrit-PatchSet: 13
    Gerrit-Owner: Gabriel Charette <g...@chromium.org>
    Gerrit-Reviewer: Gabriel Charette <g...@chromium.org>
    Gerrit-Reviewer: Hiroki Nakagawa <nhi...@chromium.org>
    Gerrit-Attention: Gabriel Charette <g...@chromium.org>
    Gerrit-Comment-Date: Wed, 08 Jul 2026 13:43:12 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: Yes
    Comment-In-Reply-To: Gabriel Charette <g...@chromium.org>
    Comment-In-Reply-To: Hiroki Nakagawa <nhi...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy
    Reply all
    Reply to author
    Forward
    0 new messages