WebContentsImpl::GetCreatedWindow has a "return nullptr" case that appears to leak the pending WebContents created by window.open(), if the process crashes at just the right moment.

This would occur if either of the following conditions caused the branch to be taken:

  if (!new_contents->GetMainFrame()->GetProcess()->HasConnection() ||
      !new_contents->GetMainFrame()->GetView()) {

GetProcess->HasConnection() seems unlikely, since we are in the middle of processing a message from exactly that process. I am not sure about the GetView() clause.

A leak may also be possible if the WebContents is closed while pending_contents_ is nonempty. This, also, should be exceptionally rare: the ShowCreatedWindow IPC is sent immediately after the CreateNewWindow IPC, but a user action is possible here. This case ought to be reproducable in a browsertest modeled after SitePerProcessBrowserTest.TwoSubframesCreatePopupsSimultaneously

I believe that these cases can be solved by having pending_contents_ hold unique_ptrs<> to its WebContents instances.
 

WebContentsImpl::GetCreatedWindow has a "return nullptr" case that appears to leak the pending WebContents created by window.open(), if the process crashes at just the right moment.

This would occur if either of the following conditions caused the branch to be taken:

  if (!new_contents->GetMainFrame()->GetProcess()->HasConnection() ||
      !new_contents->GetMainFrame()->GetView()) {

GetProcess->HasConnection() seems unlikely, since we are in the middle of processing a message from exactly that process. I am not sure about the GetView() clause.

A leak may also be possible if the WebContents is closed while pending_contents_ is nonempty. This, also, should be exceptionally rare: the ShowCreatedWindow IPC is sent immediately after the CreateNewWindow IPC, but an intervening user action is possible here. This case ought to be reproducable in a browsertest modeled after SitePerProcessBrowserTest.TwoSubframesCreatePopupsSimultaneously

I believe that these cases can be solved by having pending_contents_ hold unique_ptrs<> to its WebContents instances.