[Bug]: Asynchronous onBeforeRequest handler crashes Chromium with unretained dangling ptr error for specific websites

[mgalla10]

Preflight Checklist

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a bug report that matches the one I want to file, without success.

Electron Version

30.0.3

What operating system are you using?

Windows

Operating System Version

Windows 11 version 23H2

What arch are you using?

x64

Last Known Working Electron version

v29.3.3

Expected Behavior

Providing an asynchronous handler to a window's webContents.session.webRequest.onBeforeRequest method should not result in a crash, regardless of the website being navigated to.

Actual Behavior

If there is any asynchrony in the onBeforeRequest handler (even just a setTimeout(0) delay), attempting to navigate to or within the website "https://yahoo.com" results in Chromium crashing with the fatal error "Detected dangling raw_ptr in unretained with id=0x########". Try-catch blocks are not sufficient to keep this error from tearing down the entire application.

So far, this issue seems to be specific to https://yahoo.com, but I'm not convinced there aren't other sites out there that would also manifest the same issue.

Testcase Gist URL

https://gist.github.com/0baeefc537a83dc044f4880d9eaeb5c4

Additional Information

Using the test Gist, once Yahoo has loaded, click the main "yahoo!" button to renavigate to that page again. Within anywhere from 1 to 5 clicks, the entire app will crash and the console will display information about the dangling raw_prt error.

[clavin]

Thanks for the report! I was able to reproduce this on a Windows device, but not on my macOS device. I was able to reproduce this on Electron 30.0.3 as well as Electron 31.0.0-beta.5.

[clavin]

After more testing, I believe this crash occurs on websites that use the Service Worker Navigation Preload feature in such a way that the network request for the navigation preload gets cancelled as soon as possible. I couldn't find any other websites that have this exact setup, nor have the time right now to create a demo, but this should hopefully narrow down the problem space a lot & give clear guidance on what to make an isolated, reproducible test case for.