EmbeddedBrowserWebView.dll crash on Callback to add_NewWindowRequested only when add_ServerCertificateErrorDetected is added

[RashiGuptaFiery]

Description
On Adding add_ServerCertificateErrorDetected, to the webview,
Application crashes whenever ICoreWebView2NewWindowRequestedEventHandler is raised.

Even if the ICoreWebView2ServerCertificateErrorDetectedEventHandler is not handled, just adding "add_ServerCertificateErrorDetected" results in crash when new window is created on receiving NewWindowHandler
This has been considered and taken care https://learn.microsoft.com/en-us/microsoft-edge/webview2/concepts/threading-model

m_webView->add_NavigationStarting(
Callback(
this, ...,
&m_navigationStartingToken);
m_webView->add_NavigationCompleted(
Callback(
this, ...,
&m_navigationCompletedToken);
m_webView->add_NewWindowRequested(
Callback(
this, ..,
&m_newWindowRequestedToken);

m_webView2_14 = (ICoreWebView2_14)(m_webView.get());
if (m_webView2_14)
{
m_webView2_14->add_ServerCertificateErrorDetected(
Callback(
this, &...,
&m_serverCertificateErrorToken);
}*

Version
SDK: 1.0.1901.177
Runtime: 115.0.1901.188
Framework: Win32
OS: Win 10

Regression
Was this working before but has regressed? no

Repro Steps

Screenshots

Crash Stack
EmbeddedBrowserWebView.dll!embedded_browser_webview_current::internal::NewWindowRequestedEventArgs::NewWindowRequestedEventArgs(struct ICoreWebView2Internal *,bool,class GURL const &,class std::__1::basic_string<char,struct std::__1::char_traits,class std::__1::allocator > const &,class mojo::StructPtr,unsigned int)
EmbeddedBrowserWebView.dll!Microsoft::WRL::Details::Make<embedded_browser_webview_current::internal::NewWindowRequestedEventArgs,embedded_browser_webview_current::EmbeddedBrowserWebView *,bool &,const GURL &,const std::__1::basic_string<char,std::__1::char_traits,std::__1::allocator> &,mojo::StructPtr<embedded_browser::mojom::WindowFeatures>,unsigned int &>()
EmbeddedBrowserWebView.dll!embedded_browser_webview_current::EmbeddedBrowserWebView::OnNewWindowRequested(class GURL const &,bool,class std::__1::basic_string<char,struct std::__1::char_traits,class std::__1::allocator > const &,class mojo::StructPtr,unsigned int)
EmbeddedBrowserWebView.dll!embedded_browser::mojom::EmbeddedBrowserClientStubDispatch::Accept(class embedded_browser::mojom::EmbeddedBrowserClient *,class mojo::Message *)
EmbeddedBrowserWebView.dll!mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept(class mojo::Message *)
EmbeddedBrowserWebView.dll!mojo::MessageDispatcher::Accept(class mojo::Message *)
EmbeddedBrowserWebView.dll!mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *)
EmbeddedBrowserWebView.dll!mojo::internal::MultiplexRouter::ProcessIncomingMessage()
EmbeddedBrowserWebView.dll!mojo::internal::MultiplexRouter::Accept(class mojo::Message *)
EmbeddedBrowserWebView.dll!mojo::MessageDispatcher::Accept(class mojo::Message )
EmbeddedBrowserWebView.dll!base::internal::Invoker<base::internal::BindState<void ()(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),base::RepeatingCallback<void (unsigned int)>>,void (unsigned int, const mojo::HandleSignalsState &)>::Run()
EmbeddedBrowserWebView.dll!mojo::SimpleWatcher::OnHandleReady()
EmbeddedBrowserWebView.dll!base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &)
EmbeddedBrowserWebView.dll!base::TaskAnnotator::RunTask<>()
EmbeddedBrowserWebView.dll!embedded_browser_webview::internal::AppTaskRunner::DoWork()
EmbeddedBrowserWebView.dll!embedded_browser_webview::internal::AppTaskRunner::MessageCallback()
EmbeddedBrowserWebView.dll!base::win::MessageWindow::WindowProc()
EmbeddedBrowserWebView.dll!base::win::WrappedWindowProc<&base::win::MessageWindow::WindowProc>()
user32.dll!UserCallWinProcCheckWow()
user32.dll!DispatchMessageWorker()
user32.dll!IsDialogMessageW()

Additional context

m_serverCertificateErrorToken is always 0

Remove add_ServerCertificateErrorDetected connection, and crash does not happen
Is this the right way of adding add_ServerCertificateErrorDetected?
Issues seems to be occur only when connecting ServerCertificateEvent with webView2_14 context.

AB#46980562

[novac42]

Thanks for reporting the issue and sorry you are running into it. I've assigned this to a dev who can help follow up on this.

[LxonWWW]

Same problem here when using WinForms:

[monica-ch]

@RashiGuptaFiery @LxonWWW I am unable to repro the issue from our sample app, tested with WebView2 runtime 120.0.XXXX.0.

Have you tried adding the ServerCertificateErrorDetected event to the new webcontents and see if is working? Let me know if you still see the issue.

CHECK_FAILURE(m_webView->add_NewWindowRequested(
        Callback<ICoreWebView2NewWindowRequestedEventHandler>(
            [this](ICoreWebView2* sender, ICoreWebView2NewWindowRequestedEventArgs* args)
            {
                if (!m_shouldHandleNewWindowRequest)
                {
                    args->put_Handled(FALSE);
                    return S_OK;
                }
                wil::com_ptr<ICoreWebView2Deferral> deferral;
                CHECK_FAILURE(args->GetDeferral(&deferral));
                AppWindow* newAppWindow;

               wil::com_ptr<ICoreWebView2WindowFeatures> windowFeatures;
                CHECK_FAILURE(args->get_WindowFeatures(&windowFeatures));

                RECT windowRect = {0};
                UINT32 left = 0;
                UINT32 top = 0;
                UINT32 height = 0;
                UINT32 width = 0;
                BOOL shouldHaveToolbar = true;

                BOOL hasPosition = FALSE;
                BOOL hasSize = FALSE;
                CHECK_FAILURE(windowFeatures->get_HasPosition(&hasPosition));
                CHECK_FAILURE(windowFeatures->get_HasSize(&hasSize));

                bool useDefaultWindow = true;

                if (!!hasPosition && !!hasSize)
                {
                    CHECK_FAILURE(windowFeatures->get_Left(&left));
                    CHECK_FAILURE(windowFeatures->get_Top(&top));
                    CHECK_FAILURE(windowFeatures->get_Height(&height));
                    CHECK_FAILURE(windowFeatures->get_Width(&width));
                    useDefaultWindow = false;
                }
                CHECK_FAILURE(windowFeatures->get_ShouldDisplayToolbar(&shouldHaveToolbar));

                windowRect.left = left;
                windowRect.right =
                    left + (width < s_minNewWindowSize ? s_minNewWindowSize : width);
                windowRect.top = top;
                windowRect.bottom =
                    top + (height < s_minNewWindowSize ? s_minNewWindowSize : height);

                // passing "none" as uri as its a noinitialnavigation
                if (!useDefaultWindow)
                {
                    newAppWindow = new AppWindow(
                        m_creationModeId, GetWebViewOption(), L"none", m_userDataFolder, false,
                        nullptr, true, windowRect, !!shouldHaveToolbar);
                }
                else
                {
                    newAppWindow = new AppWindow(m_creationModeId, GetWebViewOption(), L"none");
                }
                newAppWindow->m_isPopupWindow = true;

               
                newAppWindow->m_onWebViewFirstInitialized = [args, deferral, newAppWindow, this]()
                {
                   CHECK_FAILURE(args->put_NewWindow(newAppWindow->m_webView.get()));

                   wil::com_ptr<ICoreWebView2_14> m_webView2_14;
                   CHECK_FAILURE(newAppWindow->m_webView.get()->QueryInterface(IID_PPV_ARGS(&m_webView2_14)));

                   CHECK_FAILURE(m_webView2_14->add_ServerCertificateErrorDetected(
                       Callback<ICoreWebView2ServerCertificateErrorDetectedEventHandler>(
                           [](
                               ICoreWebView2* sender,
                               ICoreWebView2ServerCertificateErrorDetectedEventArgs* args)
                           {
                               CHECK_FAILURE(args->put_Action(
                                   COREWEBVIEW2_SERVER_CERTIFICATE_ERROR_ACTION_ALWAYS_ALLOW));
                               return S_OK;
                           })
                       .Get(),
                               nullptr));

                
                    CHECK_FAILURE(args->put_Handled(TRUE));
                    CHECK_FAILURE(deferral->Complete());
                };
                return S_OK;
            })
            .Get(),
        nullptr));

[monica-ch]

Closing the thread, feel free to re-open if you still have any issues/questions.