Client crashes in SelectClientCertificate (M139)

[mbragg12]

Describe the bug
Navigating to msccruises.com while using alloy_style causes the client to crash.

To Reproduce
Steps to reproduce the behavior:

1. launch cefclient with alloy_style. i.e. cefclient --use-alloy-style
2. Go to msccruises.com

Expected behavior
Site loads

Versions (please complete the following information):

• OS: Windows 11
• CEF Version: 139.0.10 & earlier

Does the problem reproduce with Google Chrome at the same version?
No

Debugging notes:
Crash is in SelectClientCertificate in due to web_contents being null.

Stack trace:

 	libcef.dll!CefBrowserHostBase::GetBrowserForContents(const content::WebContents * contents) Line 123	C++
 	libcef.dll!ChromeContentBrowserClientCef::SelectClientCertificate(content::BrowserContext * browser_context, int process_id, content::WebContents * web_contents, net::SSLCertRequestInfo * cert_request_info, std::__Cr::vector<std::__Cr::unique_ptr<net::ClientCertIdentity,std::__Cr::default_delete<net::ClientCertIdentity>>,std::__Cr::allocator<std::__Cr::unique_ptr<net::ClientCertIdentity,std::__Cr::default_delete<net::ClientCertIdentity>>>> client_certs, std::__Cr::unique_ptr<content::ClientCertificateDelegate,std::__Cr::default_delete<content::ClientCertificateDelegate>> delegate) Line 299	C++
>	libcef.dll!content::SSLClientAuthHandler::DidGetClientCertsOnPostTask(std::__Cr::vector<std::__Cr::unique_ptr<net::ClientCertIdentity,std::__Cr::default_delete<net::ClientCertIdentity>>,std::__Cr::allocator<std::__Cr::unique_ptr<net::ClientCertIdentity,std::__Cr::default_delete<net::ClientCertIdentity>>>> client_certs) Line 116	C++
 	[Inline Frame] libcef.dll!base::internal::DecayedFunctorTraits<void (DevToolsPipeHandler::*)(std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>),base::WeakPtr<content::DevToolsPipeHandler> &&,std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>> &&>::Invoke(void(content::DevToolsPipeHandler::*)(std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>) method, const base::WeakPtr<content::DevToolsPipeHandler> & receiver_ptr, std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>> && args) Line 731	C++
 	[Inline Frame] libcef.dll!base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (DevToolsPipeHandler::*&&)(std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>),base::WeakPtr<content::DevToolsPipeHandler> &&,std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>> &&>,void,0,1>::MakeItSo(void(content::DevToolsPipeHandler::*)(std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>) && functor, std::__Cr::tuple<base::WeakPtr<content::DevToolsPipeHandler>,std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>> && bound) Line 947	C++
 	[Inline Frame] libcef.dll!base::internal::Invoker<base::internal::FunctorTraits<void (DevToolsPipeHandler::*&&)(std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>),base::WeakPtr<content::DevToolsPipeHandler> &&,std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>> &&>,base::internal::BindState<1,1,0,void (DevToolsPipeHandler::*)(std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>),base::WeakPtr<content::DevToolsPipeHandler>,std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>>,void ()>::RunImpl(void(content::DevToolsPipeHandler::*)(std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>) && functor, std::__Cr::tuple<base::WeakPtr<content::DevToolsPipeHandler>,std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>> && bound, std::__Cr::integer_sequence<unsigned long long,0,1>) Line 1060	C++
 	libcef.dll!base::internal::Invoker<base::internal::FunctorTraits<void (DevToolsPipeHandler::*&&)(std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>),base::WeakPtr<content::DevToolsPipeHandler> &&,std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>> &&>,base::internal::BindState<1,1,0,void (DevToolsPipeHandler::*)(std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>),base::WeakPtr<content::DevToolsPipeHandler>,std::__Cr::vector<unsigned char,std::__Cr::allocator<unsigned char>>>,void ()>::RunOnce(base::internal::BindStateBase * base) Line 973	C++
 	[Inline Frame] libcef.dll!base::OnceCallback<void ()>::Run() Line 156	C++
 	libcef.dll!base::TaskAnnotator::RunTaskImpl(base::PendingTask & pending_task) Line 209	C++
 	[Inline Frame] libcef.dll!base::TaskAnnotator::RunTask(perfetto::StaticString event_name, base::PendingTask & pending_task, base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl::<lambda_16> && args) Line 106	C++
 	libcef.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow * continuation_lazy_now) Line 456	C++
 	libcef.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() Line 332	C++
 	libcef.dll!base::MessagePumpForUI::DoRunLoop() Line 266	C++
 	libcef.dll!base::MessagePumpWin::Run(base::MessagePump::Delegate * delegate) Line 90	C++
 	libcef.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool application_tasks_allowed, base::TimeDelta timeout) Line 629	C++
 	libcef.dll!base::RunLoop::Run(const base::Location & location) Line 136	C++
 	libcef.dll!CefMainRunner::RunMessageLoop() Line 200	C++

[TaurusPrime]

Looks like Alloy is broken. Chrome UI is working, but nobody likes Chrome UI. B)

Maybe same problem here: #3971

[magreenblatt]

Maybe same problem here: #3971

Not related.

[magreenblatt]

This reproduces with both Alloy and Chrome style in M139, but not M138.

[mbragg12]

Very odd, we have seen it in M135 and M137. Didn't try M138.

[magreenblatt]

Looks like there are a bunch of calls where SSLClientAuthHandler::web_contents_ is non-nullptr, and then a call where it's nullptr. That nullptr call is likely coming from a service worker and should be canceled, same as in ChromeContentBrowserClient::SelectClientCertificate.

[magreenblatt]

@mbragg12 if you're building older branches it should be safe to cherry-pick this fix

[mbragg12]

@magreenblatt thanks for the quick fix.