fix(desktop): guard splash-stage teardown races (#6136)

Both pre-existing and the new structural test cases surface two
sub-races between setSplashStage → applySplashStage →
executeJavaScript and the splash BrowserWindow lifecycle:

1. Pre-load destroy (race 1): a stage is deferred while the splash
   page is still loading. Before did-finish-load fires, the splash
   window is destroyed. The existing registerSplashStageTracking
   replay callback unconditionally called applySplashStage on the
   destroyed surface, causing executeJavaScript to throw
   synchronously in Electron's teardown path. Fix: bail out of the
   replay when splash.isDestroyed() OR splash.webContents.isDestroyed().

2. Check-to-call destroy (race 2): the splash survives the
   isDestroyed() check in setSplashStage, but the underlying
   webContents is torn down before executeJavaScript runs.
   Electron throws TypeError("Object has been destroyed")
   synchronously — not as a rejected Promise — so the existing
   .catch(() => undefined) does not catch it and the exception
   escapes to the process. Fix: wrap the entire
   executeJavaScript + .catch sequence in try/catch and also
   short-circuit via webContents.isDestroyed() before the call.

SplashStageSurface gains webContents.isDestroyed() to the
structural type so callers (both production code and the mock in
the test) can explicitly probe renderer readiness.

Changes:
- apps/desktop/src/main/runtime.ts:
  - Add webContents.isDestroyed() to SplashStageSurface type.
  - applySplashStage: short-circuit via splash/isDestroyed checks
    and wrap executeJavaScript in try/catch.
  - registerSplashStageTracking: bail out of the did-finish-load
    replay when the surface or its webContents is already destroyed.
- apps/desktop/tests/main/splash-stage-replay.test.ts:
  - Add webContents.isDestroyed() to createMockSplash.
  - New test: splash destroyed before did-finish-load → no-op.
  - New test: sync throw from executeJavaScript → not thrown.

All pre-existing desktop test failures (missing @open-design/download
resolve) are pre-existing and unrelated to this change. The splash
stage replay tests typecheck clean on this branch.

Fixes #6136

Signed-off-by: xxiaoxiong <2482929840@qq.com>

Author: xxiaoxiong

apps/desktop/src/main/runtime.ts

@@ -1308,10 +1308,19 @@ function splashStagePayload(stage: SplashBootStage): { step: number; total: numb
  * Narrow view of the splash window that the stage updater needs. A real
  * `BrowserWindow` satisfies this structurally; tests pass a mock so the
  * load-ready/replay logic is exercisable without a live Electron renderer.
+ *
+ * `webContents.isDestroyed()` is part of the contract because Electron can
+ * tear a window's underlying `webContents` down before (or in between) the
+ * `isDestroyed()`-and-`executeJavaScript` boundary in `setSplashStage` /
+ * `applySplashStage`; without that probe, the synchronous
+ * `executeJavaScript` call throws `TypeError("Object has been destroyed")`
+ * — a rejection that escapes the existing `.catch` because no Promise is
+ * returned in the synchronous-throw case. See issue #6136.
  */
 export type SplashStageSurface = {
   isDestroyed(): boolean;
   webContents: {
+    isDestroyed(): boolean;
     executeJavaScript(code: string, userGesture?: boolean): Promise<unknown>;
     once(event: "did-finish-load", listener: () => void): void;
   };
@@ -1324,12 +1333,26 @@ type SplashStageState = { ready: boolean; pending: SplashBootStage | null };
 const splashStageState = new WeakMap<SplashStageSurface, SplashStageState>();
 
 function applySplashStage(splash: SplashStageSurface, stage: SplashBootStage): void {
-  void splash.webContents
-    .executeJavaScript(
-      `window.__odSplashSetStage && window.__odSplashSetStage(${JSON.stringify(splashStagePayload(stage))});`,
-      true,
-    )
-    .catch(() => undefined);
+  // Guard against the teardown race: `setSplashStage` checks
+  // `splash.isDestroyed()` before calling here, but the window can
+  // be destroyed between that check and this call (see #6136).
+  // `webContents.isDestroyed()` covers the case where the renderer
+  // tears down before the wrapper BrowserWindow is reaped.
+  if (splash.isDestroyed() || splash.webContents.isDestroyed()) return;
+  try {
+    void splash.webContents
+      .executeJavaScript(
+        `window.__odSplashSetStage && window.__odSplashSetStage(${JSON.stringify(splashStagePayload(stage))});`,
+        true,
+      )
+      .catch(() => undefined);
+  } catch {
+    // Electron can throw `TypeError("Object has been destroyed")`
+    // synchronously from executeJavaScript in the residual teardown
+    // race not covered by the isDestroyed() checks above. Mirror the
+    // Promise-rejection contract: this path is best-effort, never a
+    // process-killing uncaught exception.
+  }
 }
 
 /**
@@ -1345,6 +1368,11 @@ export function registerSplashStageTracking(splash: SplashStageSurface): void {
   const state: SplashStageState = { ready: false, pending: null };
   splashStageState.set(splash, state);
   splash.webContents.once("did-finish-load", () => {
+    // The splash or its webContents may have been destroyed between
+    // the stage being stashed and the load event firing (race 1).
+    // Bail out early rather than calling executeJavaScript on a
+    // dead renderer.
+    if (splash.isDestroyed() || splash.webContents.isDestroyed()) return;
     state.ready = true;
     if (state.pending != null) {
       const stage = state.pending;

apps/desktop/tests/main/splash-stage-replay.test.ts

@@ -29,9 +29,11 @@ function createMockSplash(): MockSplash {
   const executed: string[] = [];
   let didFinishLoad: (() => void) | null = null;
   let destroyed = false;
+  let webContentsDestroyed = false;
   const surface: SplashStageSurface = {
     isDestroyed: () => destroyed,
     webContents: {
+      isDestroyed: () => webContentsDestroyed,
       executeJavaScript: (code: string) => {
         executed.push(code);
         return Promise.resolve(undefined);
@@ -47,6 +49,7 @@ function createMockSplash(): MockSplash {
     emitDidFinishLoad: () => didFinishLoad?.(),
     destroy: () => {
       destroyed = true;
+      webContentsDestroyed = true;
     },
   };
 }
@@ -100,6 +103,45 @@ describe('splash boot-stage replay guard', () => {
     expect(splash.executed).toEqual([]);
   });
 
+  // Race 1: stage deferred before load, splash destroyed before did-finish-load.
+  // Without the guard in registerSplashStageTracking, the replay callback
+  // would call applySplashStage and then executeJavaScript on a dead surface.
+  test('is a no-op when the splash is destroyed before did-finish-load', () => {
+    const splash = createMockSplash();
+    registerSplashStageTracking(splash.surface);
+
+    setSplashStage(splash.surface, 'engine');
+    expect(splash.executed).toEqual([]);
+
+    // Destroy the splash after the stage is stashed but before load fires.
+    splash.destroy();
+    splash.emitDidFinishLoad();
+    expect(splash.executed).toEqual([]);
+  });
+
+  // Race 2: the webContents throws `TypeError("Object has been destroyed")`
+  // synchronously (not returning a rejected Promise) during executeJavaScript.
+  // The existing `.catch` only handles Promise rejections — a sync throw
+  // escapes and can crash the process. The try/catch in applySplashStage must
+  // swallow this sync throw, mirroring the existing Promise-rejection contract.
+  test('tolerates a destroyed webContents mid-flight instead of throwing', () => {
+    const surface: SplashStageSurface = {
+      isDestroyed: () => false,
+      webContents: {
+        isDestroyed: () => false,
+        executeJavaScript: () => {
+          // Simulate the teardown race: throw before returning a Promise.
+          throw new TypeError('Object has been destroyed');
+        },
+        once: () => { /* no-op */ },
+      },
+    };
+
+    // No throw — the sync exception is swallowed the same way an
+    // executeJavaScript rejection would be.
+    expect(() => setSplashStage(surface, 'engine')).not.toThrow();
+  });
+
   // Slow-cold-boot UX: the splash must tell the user WHICH step of how many is
   // underway, not just a bare label, so the wait reads as forward progress. The
   // stage payload handed to the renderer carries a 1-based step index and the