[Problem/Bug]: Runtime regression in mixed CEF/WebView2 hosting with 146 & CEF 140

[michael-russin]

What happened?

We have a windows desktop application (.net 4.8) that hosts web pages in both CEF and WebView2. The rollout of WebView2 runtime 146.0.3856.62 has started a crash in the application related to popup windows. This looks similar to #4343 We are running the CEF version 140.9.7339.185 and CEF crashes with
[2660:22900:0315/211214.734:FATAL:ui\gfx\win\hwnd_util.cc:65] 1400

If we force the application back to the 145 runtime the problem is resolved.

Importance

Important. My app's user experience is significantly compromised.

Runtime Channel

Stable release (WebView2 Runtime)

Runtime Version

146.0.3856.62

SDK Version

No response

Framework

WPF

Operating System

Windows 11

OS Version

26200.8037

Repro steps

We run our application and pages in both Edge and CEF can be views. If the CEF web page does a window.open call the crash occurs. We are trying to write a small sample to demonstrate the problem.

Repros in Edge Browser

No, issue does not reproduce in the corresponding Edge version

Regression

No, this never worked

Last working version (if regression)

145.0.3800.97

[github-actions]

Hi, @michael-russin!

It seems that your issue contains the word "crash". If you have not already, could you attach a crash dump as a comment?

WV2 crash dumps are located in a subfolder of the app's user data folder (UDF): <UDF>\EBWebView\Crashpad\reports\. By default, the user data folder is created in the app's folder with a name like <App Exe Name>.exe.WebView2. Refer to Crash Diagnostics for more information.

Thank you for your cooperation!

[rsagner]

Can not give any technical details but we can also confirm that after update to 146.0.3856.62 (from 145.0.3800.97) application using both CEF and webview2 crashes.

[michael-russin]

We're still working on getting a sample that shows the problem without proprietary code but here are more details.

In our chrome implementation we process the OnBeforePopup in the LifeSpanHandler so we can have our own custom window to host the CEF browser. In the OnBeforePopup we call windowInfo.SetAsChild passing in the parent handle from our host window and after this callback returns we get the exception. If we never initialize the WebView2 environment or if we go back to runtime 145 we avoid the crash.

[ReesyGit]

I can also confirm that after the update to 146.0.3856.62 our desktop application using both CEF and webview2 crashes.

[ArchonData]

My company's desktop application is also experiencing this issue, except that we're running CEF 131 (specifically 131.0.6778.265). We are now getting numerous reports from users who have had their WebView2 runtime updated to 146 getting crashes. Similar to the OP, downgrading back to 145 resolves the situation.

The reports we're getting show that users experiencing this issue have the same OS version and WebView2 runtime version as the OP. The last WebView2 runtime version that worked is also identical. Our application however is built on native C++/MFC.

One of the GitHub actions above suggested to attach a crash dump. Unfortunately, I can't seem to attach any of them here (probably too big). My colleague was able to generate 4 full dumps, but in all cases, the call stack is identical:

>	[Inline Frame] libcef.dll!base::ImmediateCrash() Line 186	C++
 	libcef.dll!logging::LogMessage::HandleFatal(unsigned __int64 stack_start, const std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char>> & str_newline) Line 1050	C++
 	[Inline Frame] libcef.dll!logging::LogMessage::Flush::<lambda_0>::operator()() Line 750	C++
 	[Inline Frame] libcef.dll!absl::cleanup_internal::Storage<`lambda at ..\..\base\logging.cc:748:40'>::InvokeCallback() Line 87	C++
 	[Inline Frame] libcef.dll!absl::Cleanup<absl::cleanup_internal::Tag,`lambda at ..\..\base\logging.cc:748:40'>::~Cleanup() Line 106	C++
 	libcef.dll!logging::LogMessage::Flush() Line 933	C++
 	libcef.dll!logging::LogMessageFatal::~LogMessageFatal() Line 1055	C++
 	libcef.dll!gfx::`anonymous namespace'::CrashOther(unsigned long last_error) Line 65	C++
 	libcef.dll!gfx::CheckWindowCreated(HWND__ * hwnd, unsigned long last_error) Line 222	C++
 	libcef.dll!gfx::WindowImpl::Init(HWND__ * parent, const gfx::Rect & bounds) Line 255	C++
 	[Inline Frame] libcef.dll!ui::`anonymous namespace'::TempParent::Get() Line 34	C++
 	libcef.dll!ui::GetHiddenWindow() Line 56	C++
 	libcef.dll!content::RenderWidgetHostViewAura::HideImpl() Line 677	C++
 	libcef.dll!content::RenderFrameHostManager::CommitPending(std::__Cr::unique_ptr<content::RenderFrameHostImpl,std::__Cr::default_delete<content::RenderFrameHostImpl>> pending_rfh, std::__Cr::unique_ptr<content::StoredPage,std::__Cr::default_delete<content::StoredPage>> pending_stored_page, bool clear_proxies_on_commit, bool allow_paint_holding) Line 4960	C++
 	libcef.dll!content::RenderFrameHostManager::CommitPendingIfNecessary(content::RenderFrameHostImpl * render_frame_host, bool was_caused_by_user_gesture, bool is_same_document_navigation, bool clear_proxies_on_commit, bool allow_paint_holding) Line 831	C++
 	libcef.dll!content::RenderFrameHostManager::DidNavigateFrame(content::RenderFrameHostImpl * render_frame_host, bool was_caused_by_user_gesture, bool is_same_document_navigation, bool clear_proxies_on_commit, const blink::FramePolicy & frame_policy, bool allow_paint_holding) Line 786	C++
 	libcef.dll!content::Navigator::DidNavigate(content::RenderFrameHostImpl * render_frame_host, const content::mojom::DidCommitProvisionalLoadParams & params, std::__Cr::unique_ptr<content::NavigationRequest,std::__Cr::default_delete<content::NavigationRequest>> navigation_request, bool was_within_same_document) Line 586	C++
 	libcef.dll!content::RenderFrameHostImpl::DidCommitNavigationInternal(std::__Cr::unique_ptr<content::NavigationRequest,std::__Cr::default_delete<content::NavigationRequest>> navigation_request, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams> params, mojo::StructPtr<content::mojom::DidCommitSameDocumentNavigationParams> same_document_params) Line 14751	C++
 	libcef.dll!content::RenderFrameHostImpl::DidCommitNavigation(content::NavigationRequest * committing_navigation_request, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams> params, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams> interface_params) Line 15524	C++
 	[Inline Frame] libcef.dll!base::internal::DecayedFunctorTraits<void (content::RenderFrameHostImpl::*)(content::NavigationRequest *, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>),content::RenderFrameHostImpl *,content::NavigationRequest *&&>::Invoke(void(content::RenderFrameHostImpl::*)(content::NavigationRequest *, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>) method, content::RenderFrameHostImpl * && receiver_ptr, content::NavigationRequest * && args, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams> && args, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams> && args) Line 738	C++
 	[Inline Frame] libcef.dll!base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest *, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>),content::RenderFrameHostImpl *,content::NavigationRequest *&&>,void,0,1>::MakeItSo(void(content::RenderFrameHostImpl::*)(content::NavigationRequest *, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>) && functor, std::__Cr::tuple<base::internal::UnretainedWrapper<content::RenderFrameHostImpl,base::unretained_traits::MayNotDangle,0>,base::internal::UnretainedWrapper<content::NavigationRequest,base::unretained_traits::MayNotDangle,0>> && bound, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams> && args, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams> && args) Line 930	C++
 	[Inline Frame] libcef.dll!base::internal::Invoker<base::internal::FunctorTraits<void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest *, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>),content::RenderFrameHostImpl *,content::NavigationRequest *&&>,base::internal::BindState<1,1,0,void (content::RenderFrameHostImpl::*)(content::NavigationRequest *, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>),base::internal::UnretainedWrapper<content::RenderFrameHostImpl,base::unretained_traits::MayNotDangle,0>,base::internal::UnretainedWrapper<content::NavigationRequest,base::unretained_traits::MayNotDangle,0>>,void (mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>)>::RunImpl(void(content::RenderFrameHostImpl::*)(content::NavigationRequest *, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>) && functor, std::__Cr::tuple<base::internal::UnretainedWrapper<content::RenderFrameHostImpl,base::unretained_traits::MayNotDangle,0>,base::internal::UnretainedWrapper<content::NavigationRequest,base::unretained_traits::MayNotDangle,0>> && bound, std::__Cr::integer_sequence<unsigned long long,0,1>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams> && unbound_args, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams> && unbound_args) Line 1067	C++
 	libcef.dll!base::internal::Invoker<base::internal::FunctorTraits<void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest *, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>),content::RenderFrameHostImpl *,content::NavigationRequest *&&>,base::internal::BindState<1,1,0,void (content::RenderFrameHostImpl::*)(content::NavigationRequest *, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>),base::internal::UnretainedWrapper<content::RenderFrameHostImpl,base::unretained_traits::MayNotDangle,0>,base::internal::UnretainedWrapper<content::NavigationRequest,base::unretained_traits::MayNotDangle,0>>,void (mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>)>::RunOnce(base::internal::BindStateBase * base, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams> && unbound_args, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams> && unbound_args) Line 980	C++
 	libcef.dll!base::OnceCallback<void (mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>)>::Run(mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams> args, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams> args) Line 157	C++
 	libcef.dll!content::mojom::NavigationClient_CommitNavigation_ForwardToCallback::Accept(mojo::Message * message) Line 1198	C++
 	[Inline Frame] libcef.dll!mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message * message) Line 1056	C++
 	libcef.dll!mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept(mojo::Message * message) Line 371	C++
 	libcef.dll!mojo::MessageDispatcher::Accept(mojo::Message * message) Line 43	C++
 	libcef.dll!mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message * message) Line 724	C++
 	[Inline Frame] libcef.dll!IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification scoped_urgent_message_notification) Line 1216	C++
 	[Inline Frame] libcef.dll!base::internal::DecayedFunctorTraits<void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>::Invoke(void(IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification) method, scoped_refptr<IPC::ChannelAssociatedGroupController> && receiver_ptr, mojo::Message && args, IPC::`anonymous namespace'::ScopedUrgentMessageNotification && args) Line 738	C++
 	[Inline Frame] libcef.dll!base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,void,0,1,2>::MakeItSo(void(IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification) && functor, std::__Cr::tuple<scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification> && bound) Line 930	C++
 	[Inline Frame] libcef.dll!base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunImpl(void(IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification) && functor, std::__Cr::tuple<scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification> && bound, std::__Cr::integer_sequence<unsigned long long,0,1,2>) Line 1067	C++
 	libcef.dll!base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunOnce(base::internal::BindStateBase * base) Line 980	C++
 	[Inline Frame] libcef.dll!base::OnceCallback<void ()>::Run() Line 156	C++
 	libcef.dll!base::TaskAnnotator::RunTaskImpl(base::PendingTask & pending_task) Line 202	C++
 	[Inline Frame] libcef.dll!base::TaskAnnotator::RunTask(perfetto::StaticString event_name, base::PendingTask & pending_task, base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl::<lambda_4> && args) Line 98	C++
 	[Inline Frame] libcef.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow * continuation_lazy_now) Line 471	C++
 	libcef.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() Line 332	C++
 	libcef.dll!base::MessagePumpForUI::DoRunLoop() Line 257	C++
 	libcef.dll!base::MessagePumpWin::Run(base::MessagePump::Delegate * delegate) Line 84	C++
 	libcef.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool application_tasks_allowed, base::TimeDelta timeout) Line 644	C++
 	libcef.dll!base::RunLoop::Run(const base::Location & location) Line 135	C++
 	libcef.dll!CefMainRunner::RunMessageLoop() Line 198	C++
 	libcef.dll!CefUIThread::ThreadMain() Line 106	C++
 	libcef.dll!base::`anonymous namespace'::ThreadFunc(void * params) Line 124	C++
 	kernel32.dll!BaseThreadInitThunk()	Unknown
 	ntdll.dll!RtlUserThreadStart()	Unknown

Edit: Added exact CEF version.

[BadhriRavi91]

Hi @michael-russin ,

This crash pattern — [FATAL:hwnd_util.cc(65)] 1400 (ERROR_INVALID_WINDOW_HANDLE) — occurs when CEF (Chromium Embedded Framework) and the WebView2 Evergreen Runtime coexist in the same process but are built on different Chromium major versions. When CEF and WebView2 both initialize Chromium internals, they register shared Win32 window classes (e.g., Chrome_WidgetWin_0). If the two Chromium versions disagree on the layout or behavior of those classes, CreateWindowEx fails for one of them, producing error 1400.

This is a recurrence of the same class of issue previously reported in #4343 (Runtime 121 vs. older CEF)

The WebView2 Evergreen Runtime updated from Chromium 145 to Chromium 146. Your application uses CEF based on Chromium 140 (CEF 140.9.7339.185). The Chromium major version mismatch (140 vs. 146) causes the window class registration conflict.

Some workarounds to unblock:

1. If you can upgrade CEF to a version built on Chromium 146 when one becomes available, the conflict would be resolved.
2. If architecturally possible, host CEF and WebView2 in separate processes to avoid shared Chromium state conflicts.

We are routing this internally for further investigation. Hosting CEF and WebView2 in the same process across different Chromium versions is a known fragile configuration, and we'll evaluate whether the runtime can be made more resilient to this scenario.

Could you also confirm:

Which WebView2 SDK version (NuGet package) you are using?
Is the CEF browser created before or after the WebView2 environment?
Can you share a minimal repro project or a pseudocode outline of initialization order?
This information will help us file a comprehensive internal bug report.

[salvadordf]

I'm the maintainer of the CEF4Delphi and WebView4Delphi projects.

I'm getting reports from other developers about similar crashes when they mix CEF 145.0.28 and WebView2 1.0.3856.49. The crash happens when the application creates a WebView2 browser before creating a CEF browser.

I even created a demo to test this scenario but so far I'm unable to reproduce it. Perhaps my system is not completely updated.

[salvadordf]

I just tested the dual browser demo in another system and I can reproduce this issue.
I can confirm that initializing a WebView2 146 browser before a CEF 145 browser causes this crash.

[salvadordf]

I just updated CEF4Delphi to the beta version of CEF 146 and now this issue is fixed.

[michael-russin]

Upgrading to 146 does seem to resolve the issue, but it's not a great solution since we have 1000s of users that would have to update. Here is a stack trace of the crash.

`0:055> kb

ChildEBP RetAddr Args to Child

00 (Inline) -------- -------- -------- -------- libcef!base::ImmediateCrash [Y:\work\CEF3_git\chromium\src\base\immediate_crash.h @ 180]
01 2fcfdd54 2336a0e6 00000043 2fcfdd80 251a4c50 libcef!logging::LogMessage::HandleFatal+0x12b [Y:\work\CEF3_git\chromium\src\base\logging.cc @ 1072]
02 (Inline) -------- -------- -------- -------- libcef!logging::LogMessage::Flush::<lambda_0>::operator()+0x48 [Y:\work\CEF3_git\chromium\src\base\logging.cc @ 768]
03 (Inline) -------- -------- -------- -------- libcef!absl::cleanup_internal::Storage<lambda at ..\..\base\logging.cc:766:40'>::InvokeCallback+0x48 [Y:\work\CEF3_git\chromium\src\third_party\abseil-cpp\absl\cleanup\internal\cleanup.h @ 86] 04 (Inline) -------- -------- -------- -------- libcef!absl::Cleanup<absl::cleanup_internal::Tag,lambda at ....\base\logging.cc:766:40'>::~Cleanup+0x48 [Y:\work\CEF3_git\chromium\src\third_party\abseil-cpp\absl\cleanup\cleanup.h @ 106]
05 2fcfddc0 2888d548 2fcfde78 28b35a92 2cbc0244 libcef!logging::LogMessage::Flush+0x4b6 [Y:\work\CEF3_git\chromium\src\base\logging.cc @ 951]
06 2fcfddc8 28b35a91 2cbc0244 00000003 2cd98970 libcef!logging::LogMessageFatal::~LogMessageFatal+0x8 [Y:\work\CEF3_git\chromium\src\base\logging.cc @ 1078]
07 2fcfde78 234e967f 00000000 31889ec8 01cfdea4 libcef!gfx::anonymous namespace'::CrashOther+0x32 08 2fcfdf2c 23a096fe 00000000 00000578 0001000c libcef!gfx::CheckWindowCreated+0x5f [Y:\work\CEF3_git\chromium\src\ui\gfx\win\hwnd_util.cc @ 335] 09 2fcfdfb0 235182ae 0001000c 2fcfdfc0 00000000 libcef!gfx::WindowImpl::Init+0x16e [Y:\work\CEF3_git\chromium\src\ui\gfx\win\window_impl.cc @ 254] 0a (Inline) -------- -------- -------- -------- libcef!ui::anonymous namespace'::TempParent::Get+0x8b [Y:\work\CEF3_git\chromium\src\ui\base\win\hidden_window.cc @ 34]
0b 2fcfdfe0 22e3818d 31976310 00000000 22e387d0 libcef!ui::GetHiddenWindow+0x9e [Y:\work\CEF3_git\chromium\src\ui\base\win\hidden_window.cc @ 56]
0c 2fcfdff8 22e387e6 2fcfe064 235c238f 3fc80980 libcef!content::RenderWidgetHostViewAura::RemovingFromRootWindow+0xbd [Y:\work\CEF3_git\chromium\src\content\browser\renderer_host\render_widget_host_view_aura.cc @ 3035]
0d 2fcfe000 235c238f 3fc80980 00000000 31841140 libcef!content::RenderWidgetHostViewAura::WindowObserver::OnWindowRemovingFromRootWindow+0x16 [Y:\work\CEF3_git\chromium\src\content\browser\renderer_host\render_widget_host_view_aura.cc @ 250]
0e 2fcfe064 235c24df 00000000 31f4a1e0 31f4a220 libcef!aura::Window::NotifyRemovingFromRootWindow+0xdf [Y:\work\CEF3_git\chromium\src\ui\aura\window.cc @ 1228]
0f 2fcfe0c8 235c09d8 00000000 32036ac0 32036ae8 libcef!aura::Window::NotifyRemovingFromRootWindow+0x22f [Y:\work\CEF3_git\chromium\src\ui\aura\window.cc @ 1231]
10 2fcfe130 235c0201 3fc80c40 435f3860 2fcfe158 libcef!aura::Window::RemoveChildImpl+0x228 [Y:\work\CEF3_git\chromium\src\ui\aura\window.cc @ 1146]
11 2fcfe1cc 23777a60 3fc80c40 2fcfe1dc 00000000 libcef!aura::Window::AddChild+0x141 [Y:\work\CEF3_git\chromium\src\ui\aura\window.cc @ 557]
12 (Inline) -------- -------- -------- -------- libcef!views::anonymous namespace'::ReparentAuraWindow+0xd [Y:\work\CEF3_git\chromium\src\ui\views\widget\native_widget_aura.cc @ 142] 13 2fcfe204 23784304 3fc80c40 435f3860 3ff5ce40 libcef!views::internal::NativeWidgetPrivate::ReparentNativeView+0x60 [Y:\work\CEF3_git\chromium\src\ui\views\widget\native_widget_aura.cc @ 1604] 14 2fcfe224 23bf3667 3fc80c40 435f3860 3fc80c9c libcef!views::Widget::ReparentNativeView+0x14 [Y:\work\CEF3_git\chromium\src\ui\views\widget\widget.cc @ 398] 15 2fcfe244 23bf33fc 3ff5ce40 31817c50 23bf3340 libcef!views::NativeViewHostAura::AddClippingWindow+0x57 [Y:\work\CEF3_git\chromium\src\ui\views\controls\native\native_view_host_aura.cc @ 320] 16 2fcfe258 237a74c8 3fd33f40 3fc80c40 3fd34104 libcef!views::NativeViewHostAura::AttachNativeView+0xbc [Y:\work\CEF3_git\chromium\src\ui\views\controls\native\native_view_host_aura.cc @ 110] 17 2fcfe26c 23854ede 3fc80c40 3fd34030 3fc80c40 libcef!views::NativeViewHost::Attach+0x28 [Y:\work\CEF3_git\chromium\src\ui\views\controls\native\native_view_host.cc @ 41] 18 2fcfe2a8 23854aa9 00000000 22e84b30 3ff8a010 libcef!views::WebView::AttachWebContentsNativeView+0x12e [Y:\work\CEF3_git\chromium\src\ui\views\controls\webview\webview.cc @ 471] 19 2fcfe2d4 238afa90 31ea4f00 31eb3800 238afa80 libcef!views::WebView::SetWebContents+0x109 [Y:\work\CEF3_git\chromium\src\ui\views\controls\webview\webview.cc @ 118] 1a 2fcfe2e8 238b4325 31ea4f00 3fd33f40 31ea4f04 libcef!ContentsWebView::SetWebContents+0x10 [Y:\work\CEF3_git\chromium\src\chrome\browser\ui\views\frame\contents_web_view.cc @ 105] 1b 2fcfe330 238da565 00000000 31ea4f00 00000000 libcef!BrowserView::OnActiveTabChanged+0x4d5 [Y:\work\CEF3_git\chromium\src\chrome\browser\ui\views\frame\browser_view.cc @ 1990] 1c 2fcfe38c 238da1d0 00000000 31ea4f00 00000000 libcef!Browser::OnActiveTabChanged+0xd5 [Y:\work\CEF3_git\chromium\src\chrome\browser\ui\browser.cc @ 3297] 1d 2fcfe3d4 232755ac 31848040 2fcfe4b0 2fcfe510 libcef!Browser::OnTabStripModelChanged+0x1d0 [Y:\work\CEF3_git\chromium\src\chrome\browser\ui\browser.cc @ 1679] 1e 2fcfe420 2327955c 2fcfe4b0 2fcfe510 2fcfe448 libcef!TabStripModel::OnChange+0x11c [Y:\work\CEF3_git\chromium\src\chrome\browser\ui\tabs\tab_strip_model.cc @ 572] 1f 2fcfe5b8 2327521e 00000000 00000000 00000000 libcef!TabStripModel::InsertTabAtIndexImpl+0x43c [Y:\work\CEF3_git\chromium\src\chrome\browser\ui\tabs\tab_strip_model.cc @ 4083] 20 2fcfe644 23278446 00000000 435d8a80 00000001 libcef!TabStripModel::InsertTabAtImpl+0x15e [Y:\work\CEF3_git\chromium\src\chrome\browser\ui\tabs\tab_strip_model.cc @ 3296] 21 2fcfe700 281ca810 435d8a80 ffffffff 00000006 libcef!TabStripModel::AddTab+0x346 [Y:\work\CEF3_git\chromium\src\chrome\browser\ui\tabs\tab_strip_model.cc @ 1545] 22 2fcfe748 223d519b 31ea4f00 ffffffff 00000006 libcef!TabStripModel::AddWebContents+0x70 [Y:\work\CEF3_git\chromium\src\chrome\browser\ui\tabs\tab_strip_model.cc @ 1455] 23 2fcfe888 223d24f3 00000000 00000000 251b1032 libcef!ChromeBrowserHostImpl::AddNewContents+0x14b [Y:\work\CEF3_git\chromium\src\cef\libcef\browser\chrome\chrome_browser_host_impl.cc @ 129] 24 2fcfe9d8 238cae44 2fcfe9f8 31ea4f00 35bf302c libcef!ChromeBrowserDelegate::AddWebContents+0x63 [Y:\work\CEF3_git\chromium\src\cef\libcef\browser\chrome\chrome_browser_delegate.cc @ 215] 25 2fcfeca8 295a1afa 31eb9600 35b63400 31ea4f00 libcef!chrome::AddWebContents+0x44 [Y:\work\CEF3_git\chromium\src\chrome\browser\ui\browser_tabstrip.cc @ 101] 26 2fcfed1c 273d981d 35b63400 31ea4f00 2fcfed68 libcef!Browser::AddNewContents+0xca [Y:\work\CEF3_git\chromium\src\chrome\browser\ui\browser.cc @ 2266] 27 2fcfede4 22de8958 3fdde000 0000000a 00000005 libcef!content::WebContentsImpl::ShowCreatedWindow+0x22d [Y:\work\CEF3_git\chromium\src\content\browser\web_contents\web_contents_impl.cc @ 5672] 28 2fcff174 2642d426 3fcba540 34572a00 2fcff184 libcef!content::RenderFrameHostImpl::CreateNewWindow+0xd18 [Y:\work\CEF3_git\chromium\src\content\browser\renderer_host\render_frame_host_impl.cc @ 10004] 29 2fcff1a4 272d58f8 3fdde014 2fcff32c 00000000 libcef!content::mojom::FrameHostStubDispatch::AcceptWithResponder+0x106 [Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\gen\content\common\frame.mojom.cc @ 6309] 2a 2fcff1c0 2520aad9 2fcff32c 345707a0 2fcff32c libcef!content::mojom::FrameHostStub<mojo::RawPtrImplRefTraits<content::mojom::FrameHost> >::AcceptWithResponder+0x28 [Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\gen\content\common\frame.mojom.h @ 823] 2b (Inline) -------- -------- -------- -------- libcef!base::WeakPtr<mojo::InterfaceEndpointClient>::get+0x4 [Y:\work\CEF3_git\chromium\src\base\memory\weak_ptr.h @ 238] 2c (Inline) -------- -------- -------- -------- libcef!base::WeakPtr<mojo::InterfaceEndpointClient>::operator bool+0x4 [Y:\work\CEF3_git\chromium\src\base\memory\weak_ptr.h @ 255] 2d 2fcff21c 2533853c 2fcff32c 3ff41854 3fe43870 libcef!mojo::InterfaceEndpointClient::HandleValidatedMessage+0x159 [Y:\work\CEF3_git\chromium\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc @ 1072] 2e 2fcff250 2520bfdc 2fcff32c 2d0a10c0 0f79e4e5 libcef!mojo::MessageDispatcher::Accept+0xfc [Y:\work\CEF3_git\chromium\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc @ 48] 2f 2fcff310 239d2452 2fcff32c 3ff417c0 3fc63520 libcef!mojo::InterfaceEndpointClient::HandleIncomingMessage+0x4c [Y:\work\CEF3_git\chromium\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc @ 731] 30 2fcff37c 239d2886 00000004 00000000 00000000 libcef!IPC::ChannelAssociatedGroupController::AcceptSyncMessage+0x112 [Y:\work\CEF3_git\chromium\src\ipc\ipc_mojo_bootstrap.cc @ 1246] 31 2fcff3a0 239d2815 239d2340 00000000 32b5ea10 libcef!base::internal::DecayedFunctorTraits<void (ChannelAssociatedGroupController::*)(unsigned int, unsigned int, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) __attribute__((thiscall)),IPC::ChannelAssociatedGroupController *&&,unsigned int &&,unsigned int &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>::Invoke<void (ChannelAssociatedGroupController::*)(unsigned int, unsigned int, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) __attribute__((thiscall)),scoped_refptr<IPC::ChannelAssociatedGroupController>,unsigned int,unsigned int,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>+0x46 [Y:\work\CEF3_git\chromium\src\base\functional\bind_internal.h @ 731] 32 (Inline) -------- -------- -------- -------- libcef!base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(unsigned int, unsigned int, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) __attribute__((thiscall)),IPC::ChannelAssociatedGroupController *&&,unsigned int &&,unsigned int &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,void,0,1,2,3>::MakeItSo+0x2c [Y:\work\CEF3_git\chromium\src\base\functional\bind_internal.h @ 923] 33 (Inline) -------- -------- -------- -------- libcef!base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(unsigned int, unsigned int, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) __attribute__((thiscall)),IPC::ChannelAssociatedGroupController *&&,unsigned int &&,unsigned int &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(unsigned int, unsigned int, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) __attribute__((thiscall)),scoped_refptr<IPC::ChannelAssociatedGroupController>,unsigned int,unsigned int,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunImpl+0x2c [Y:\work\CEF3_git\chromium\src\base\functional\bind_internal.h @ 1060] 34 2fcff3cc 251bafe3 32b5e9f0 ffffff00 ffffffff libcef!base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(unsigned int, unsigned int, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) __attribute__((thiscall)),IPC::ChannelAssociatedGroupController *&&,unsigned int &&,unsigned int &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(unsigned int, unsigned int, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) __attribute__((thiscall)),scoped_refptr<IPC::ChannelAssociatedGroupController>,unsigned int,unsigned int,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunOnce+0x45 [Y:\work\CEF3_git\chromium\src\base\functional\bind_internal.h @ 973] 35 (Inline) -------- -------- -------- -------- libcef!base::OnceCallback<void ()>::Run+0x24 [Y:\work\CEF3_git\chromium\src\base\functional\callback.h @ 156] 36 2fcff424 25327c3b 32bdd000 b9b85bea 00000014 libcef!base::TaskAnnotator::RunTaskImpl+0x103 [Y:\work\CEF3_git\chromium\src\base\task\common\task_annotator.cc @ 207] 37 (Inline) -------- -------- -------- -------- libcef!base::TaskAnnotator::RunTask+0x6a [Y:\work\CEF3_git\chromium\src\base\task\common\task_annotator.h @ 104] 38 (Inline) -------- -------- -------- -------- libcef!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl+0x3ec [Y:\work\CEF3_git\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc @ 456] 39 2fcff5d8 251adf7f 2fcff600 00000002 00003e80 libcef!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork+0x47b [Y:\work\CEF3_git\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc @ 330] 3a 2fcff634 23331912 2ecfc7c8 ffff0000 0f79e0c5 libcef!base::MessagePumpForUI::DoRunLoop+0x5f [Y:\work\CEF3_git\chromium\src\base\message_loop\message_pump_win.cc @ 261] 3b 2fcff654 23919f43 2ecfc7c8 2fcff678 2ecfc860 libcef!base::MessagePumpWin::Run+0xb2 [Y:\work\CEF3_git\chromium\src\base\message_loop\message_pump_win.cc @ 89] 3c 2fcff6ac 2335700d 00000001 ffffffff 7fffffff libcef!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run+0x113 [Y:\work\CEF3_git\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc @ 632] 3d 2fcff71c 223fa454 2fcff728 2cd95db8 2cd95d3a libcef!base::RunLoop::Run+0xed [Y:\work\CEF3_git\chromium\src\base\run_loop.cc @ 136] 3e 2fcff76c 224542a9 2ec40320 0000000b 80000010 libcef!CefMainRunner::RunMessageLoop+0xe4 [Y:\work\CEF3_git\chromium\src\cef\libcef\browser\main_runner.cc @ 156] 3f 2fcff790 2332cffa 2ec603f0 00000001 000019dc libcef!CefUIThread::ThreadMain+0xc9 [Y:\work\CEF3_git\chromium\src\cef\libcef\browser\ui_thread.cc @ 105] 40 2fcff7b4 77d25d49 2ec801c0 77d25d30 2fcff81c libcef!base::anonymous namespace'::ThreadFunc+0x10a [Y:\work\CEF3_git\chromium\src\base\threading\platform_thread_win.cc @ 107]
41 2fcff7c4 77e8d81b 2ec801c0 edb88e58 00000000 KERNEL32!BaseThreadInitThunk+0x19
42 2fcff81c 77e8d7a1 ffffffff 77ed46c4 00000000 ntdll!__RtlUserThreadStart+0x2b
43 2fcff82c 00000000 00000000 00000000 00000000 ntdll!_RtlUserThreadStart+0x1b
`

[BadhriRavi91]

Hi, Thanks for all the info provided. We are tracking this bug internally and will update here once we get to the resolution. Thanks again !

[tabs]

I am experiencing the same issue. Following for updates.
Reproduced the same bug. Looking forward to a fix.
Same here. Waiting for a resolution.

We are encountering a critical regression where recent WebView2 background updates are causing our legacy CEF integration to crash consistently. Due to the extensive architectural changes required, upgrading to the latest CEF version is not a viable option for us at this time. Since WebView2's 'Evergreen' updates are mandatory and out of our control, this has essentially broken our production environment. We are looking for a workaround or a fix that restores compatibility with older Chromium-based frameworks.