Comment #12 on issue 24248 by [email protected]: Crash - RenderWidgetHostViewWin::OnFinalMessage(HWND__ *) http://code.google.com/p/chromium/issues/detail?id=24248
It definitely looks like render_widget_host_ has been deleted. From the stack, one explanation could be that the HWND is being destroyed while processing another message. That would cause OnFinalMessage to be invoked after the last message has been processed (that's how ATL works, it unwinds the stack first and then calls OnFinalMessage). That would explain why the stack is showing OnFinalMessage with no prior call to DestroyWindow. I could not find by expecting the code and putting breakpoints how this could be. I tried pretty much anything I could think of that uses render widget hosts: tabs, selects, popups, extensions popups, interstitial pages. There are several ways the RenderWidgetHostViewWin can be destroyed. 1 - The user closes a tab. The tab when destroyed destroys the HWND of the RenderWidgetHostViewWin, then the render view host. 2 - The user navigates to a new page: the render widget host is shutdown, it destroy its associated RenderWidgetHostViewWin before deleting itself. 3 - The render view host process is killed. It notifies the RenderWidgetHostViewWin by calling RenderViewGone, which causes it to destroy itself. So to make a long story short, I am not sure how the crasher can happen. I am going to put a workaround with a DCHECK to detect the crasher condition. -- You received this message because you are listed in the owner or CC fields of this issue, or because you starred this issue. You may adjust your issue notification preferences at: http://code.google.com/hosting/settings --~--~---------~--~----~------------~-------~--~----~ Automated mail from issue updates at http://crbug.com/ Subscription options: http://groups.google.com/group/chromium-bugs -~----------~----~----~----~------~----~------~--~---
