[Bug]: Browser crashes when closing form with the download window open

[fvanheeswijk]

What happened?

In our Windows Forms application, we have the capability to open forms containing WebView2 browsers. We encountered a crash when we opened a form with a WebView2 browser, initiated and completed a file download, and then closed the form while the download window was still open.

We haven't been able to create a reproducible example outside our application, but we do have a minidump file.
We don't yet feel comfortable sharing a minidump file as it might contain confidential data, but we have analyzed it via WinDbg.

---

* *
* Exception Analysis *
* *

---

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 7875

Key  : Analysis.Elapsed.mSec
Value: 18025

Key  : Analysis.IO.Other.Mb
Value: 339

Key  : Analysis.IO.Read.Mb
Value: 2

Key  : Analysis.IO.Write.Mb
Value: 709

Key  : Analysis.Init.CPU.mSec
Value: 7531

Key  : Analysis.Init.Elapsed.mSec
Value: 103758

Key  : Analysis.Memory.CommitPeak.Mb
Value: 1382

Key  : Analysis.Version.DbgEng
Value: 10.0.27725.1000

Key  : Analysis.Version.Description
Value: 10.2408.27.01 amd64fre

Key  : Analysis.Version.Ext
Value: 1.2408.27.1

Key  : Failure.Bucket
Value: BREAKPOINT_80000003_msedge.dll!embedded_browser::EmbeddedBrowserImpl::SetIsVisible

Key  : Failure.Hash
Value: {324dd19d-9fe7-7215-4a57-6f9f829ed7e4}

Key  : Timeline.OS.Boot.DeltaSec
Value: 93946

Key  : Timeline.Process.Start.DeltaSec
Value: 32

Key  : WER.OS.Branch
Value: ge_release

Key  : WER.OS.Version
Value: 10.0.26100.1

Key  : WER.Process.Version
Value: 131.0.2903.112

FILE_IN_CAB: 35027f38-30f4-4371-97fb-6ad584b837f9.dmp

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

CONTEXT: (.ecxr)
rax=0000000000000000 rbx=000000009a5fce01 rcx=000064ddb9bae0d2
rdx=ffffffffffffffff rsi=0000684405519100 rdi=0000000000000000
rip=00007ffb1742c499 rsp=000000f99a5fc890 rbp=0000000000000000
r8=0000684406200be0 r9=000068440657c000 r10=000000000000fffe
r11=0000000000000246 r12=000000f99a5fc8b0 r13=000000f99a5fd301
r14=0000684405fb0a00 r15=000068440629c280
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
msedge!embedded_browser::EmbeddedBrowserImpl::SetIsVisible+0x439:
00007ffb`1742c499 cc int 3
Resetting default scope

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffb1742c499 (msedge!embedded_browser::EmbeddedBrowserImpl::SetIsVisible+0x0000000000000439)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000

PROCESS_NAME: msedgewebview2.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached.

EXCEPTION_CODE_STR: 80000003

EXCEPTION_PARAMETER1: 0000000000000000

STACK_TEXT:
000000f99a5fc890 00007ffb14d62eed : 00007ffb1efb6f80 0000642423e52832 0000000000000070 0000000000000000 : msedge!embedded_browser::EmbeddedBrowserImpl::SetIsVisible+0x439
000000f99a5fc910 00007ffb0fddcc38 : 0000000000000000 00007ffb0f730543 000000f99a5fcec0 00007ffb1d59dc68 : msedge!embedded_browser::mojom::EmbeddedBrowserStubDispatch::Accept+0x7ed
000000f99a5fcbe0 00007ffb0f769761 : 000000f99a5fd050 00007ffb12b63543 0000000000000001 00007ffb0f7695f5 : msedge!mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept+0x168
000000f99a5fcca0 00007ffb0f7694c1 : aaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaa 0000684000224000 0000684406a36120 : msedge!mojo::MessageDispatcher::Accept+0x71
000000f99a5fcd10 00007ffb0f769139 : aaaaaaaaaaaaaaaa 000000f99a5fd0a8 0000000000000001 aaaaaaaaaaaaaaaa : msedge!mojo::InterfaceEndpointClient::HandleIncomingMessage+0x57
000000f99a5fcea0 00007ffb0f768c02 : 0000000000000000 000000f800000000 0000000000000000 00007ffb0f7c0b5e : msedge!mojo::internal::MultiplexRouter::ProcessIncomingMessage+0x121
000000f99a5fcf80 00007ffb0f769761 : 0000684406a36148 0000000000000000 0000000000000000 aaaaaaaa00000000 : msedge!mojo::internal::MultiplexRouter::Accept+0x152
000000f99a5fd190 00007ffb0f7bccc0 : 0000684405168d30 0000000000000000 0000000000000000 0000000000000000 : msedge!mojo::MessageDispatcher::Accept+0x71
000000f99a5fd200 00007ffb0f7bc428 : 000002aeee11d368 0000642423e53392 0000000000000008 0000684000049470 : msedge!mojo::Connector::DispatchMessageW+0x242
000000f99a5fd370 00007ffb12b4acde : 000002aeeee6ac80 000002aeeed95060 0000000000000000 000002aeee1700b0 : msedge!mojo::Connector::ReadAllAvailableMessages+0xdc
000000f99a5fdd80 00007ffb12b6852b : 000000f99a5fe5e0 0000000000000001 00006840000ac900 0000000000000000 : msedge!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork+0x71e
000000f99a5fe510 00007ffb12d70cc3 : 0000642423e50682 0000642423e506a2 0000000004d4e001 0000684000019b10 : msedge!base::MessagePumpForUI::DoRunLoop+0x24b
000000f99a5fe690 00007ffb10e0e9cf : 0000000000000000 0000000000000008 0000000000000000 000000f99a5fe818 : msedge!base::MessagePumpWin::Run+0x93
000000f99a5fe710 00007ffb11023ad4 : 000000f99a5fe818 0000684000054140 00006840000199f8 00007ffb110ff448 : msedge!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run+0xcf
000000f99a5fe790 00007ffb11d99a34 : aaaaaaaaaaaaaa00 aaaaaaaaaaaaaa00 aaaaaaaaaaaaaa00 0000000000000000 : msedge!base::RunLoop::Run+0xa4
000000f99a5fe7f0 00007ffb0eeef073 : 0000000000000001 000000f99a5fe938 0000000000000000 00007ffb0ef3e42b : msedge!content::BrowserMainLoop::RunMainMessageLoop+0x9a
000000f99a5fe860 00007ffb0eeee285 : 000000f99a5ff290 0000642423e50872 aaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaa : msedge!content::BrowserMain+0xe7
000000f99a5fe910 00007ffb0eeed4cd : aaaaaaaaaaaaaaaa 0000000000000000 00000000ffffffff 0000684000068370 : msedge!content::RunBrowserProcessMain+0xd3
000000f99a5fea60 00007ffb0eee1d15 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : msedge!content::ContentMainRunnerImpl::RunBrowser+0x463
000000f99a5febd0 00007ffb0eee1380 : 0000000000000000 00006840000545f0 0000000000000000 aaaaaaaaaaaaaaaa : msedge!content::ContentMainRunnerImpl::Run+0x285
000000f99a5fed40 00007ffb0eee08bb : aaaaaaaaaaaaaaaa 000000f99a5ff1f0 00007ffb1d068eb4 00007ffb0eee0722 : msedge!content::RunContentProcess+0x259
000000f99a5fefb0 00007ffb0eee01dd : 00007ff606cc0000 000000f99a5ff3f0 0000123000068140 00007ff600000346 : msedge!content::ContentMain+0x73
000000f99a5ff040 00007ff606d156f9 : 000012300007c280 00007ffb0eedfeb0 0000000000000000 0000000000000000 : msedge!ChromeMain+0x32d
000000f99a5ff390 00007ff606d135c2 : 000000f99a5ff780 0000123000068140 0000000000000001 0000000000000000 : msedgewebview2!MainDllLoader::Launch+0x3bd
000000f99a5ff620 00007ff606e14192 : 00007ff606f390a0 00007ff606e14209 0000000000000000 0000000000000000 : msedgewebview2!wWinMain+0x3ed
000000f99a5ffb20 00007ffb95b5e8d7 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : msedgewebview2!__scrt_common_main_seh+0x106
000000f99a5ffb60 00007ffb9677fbcc : 0000000000000000 0000000000000000 000004f0fffffb30 000004d0fffffb30 : kernel32!BaseThreadInitThunk+0x17
000000f99a5ffb90 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : ntdll!RtlUserThreadStart+0x2c

STACK_COMMAND: ~0s; .ecxr ; kb

SYMBOL_NAME: msedge!embedded_browser::EmbeddedBrowserImpl::SetIsVisible+439

MODULE_NAME: msedge

IMAGE_NAME: msedge.dll

FAILURE_BUCKET_ID: BREAKPOINT_80000003_msedge.dll!embedded_browser::EmbeddedBrowserImpl::SetIsVisible

OS_VERSION: 10.0.26100.1

BUILDLAB_STR: ge_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

IMAGE_VERSION: 131.0.2903.112

FAILURE_ID_HASH: {324dd19d-9fe7-7215-4a57-6f9f829ed7e4}

Followup: MachineOwner

Importance

Important. My app's user experience is significantly compromised.

Runtime Channel

Stable release (WebView2 Runtime)

Runtime Version

131.0.2903.112

SDK Version

1.0.2739.15

Framework

Winforms

Operating System

Windows 11

OS Version

26100.2605

Repro steps

1. Launch the Windows Forms application.
2. Open a form that contains a WebView2 browser.
3. Navigate to a website where you can download a file.
4. Initiate a file download using the WebView2 browser.
5. Wait for the download to complete, ensuring the download window is still open.
6. Close the form that contains the WebView2 browser while the download window remains open.
7. Observe that the application crashes.

On the stable runtime the issue seems to reproduce consistently. We also tested on the 132.0.2957.93 beta runtime and while it still crashes it seems to do so less often.

Repros in Edge Browser

No, issue does not reproduce in the corresponding Edge version

Regression

Regression in newer Runtime

Last working version (if regression)

Unknown

[github-actions]

Hi, @fvanheeswijk!

It seems that your issue contains the word "crash". If you have not already, could you attach a crash dump as a comment?

WV2 crash dumps are located in a subfolder of the app's user data folder (UDF): <UDF>\EBWebView\Crashpad\reports\. By default, the user data folder is created in the app's folder with a name like <App Exe Name>.exe.WebView2. Refer to Crash Diagnostics for more information.

Thank you for your cooperation!