Repository: electron
Issue: [Bug]: Double Free During Shutdown
Labels: platform/windows,bug :beetle:,17-x-y

### Preflight Checklist

- [X] I have read the [Contributing Guidelines](https://github.com/electron/electron/blob/main/CONTRIBUTING.md) for this project.
- [X] I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) that this project adheres to.
- [X] I have searched the [issue tracker](https://www.github.com/electron/electron/issues) for a bug report that matches the one I want to file, without success.

### Electron Version

17.0.0

### What operating system are you using?

Windows

### Operating System Version

Windows 10 build 19044.1526

### What arch are you using?

x64

### Last Known Working Electron version

11.4.11

### Expected Behavior

The application should shutdown without raising an unhandled exception.

### Actual Behavior

There is a race condition that results in an exception when attempting to clean up an object that no longer exists.

### Testcase Gist URL

_No response_

### Additional Information

We can reproduce the crash fairly consistently within our internal testing environments. We have robust crash data collection, which allows us to track issues like this through time, so we are 99.99% positive the crashes were not occurring prior to upgrading to electron 16.0.5 from electron 11.4.11. The crash is still reproducible with electron 17.0.0. This is a critical issue for us because we are seeing the crash ~60 times per day within our internal testing environments. Here is the callstack:

05 KERNELBASE!UnhandledExceptionFilter
06 ntdll!RtlUserThreadStart$filt$0
07 ntdll!_C_specific_handler
08 ntdll!RtlpExecuteHandlerForException
09 ntdll!RtlDispatchException
0a ntdll!KiUserExceptionDispatch
0b Hyperdrive!v8::internal::GlobalHandles::NodeSpace<v8::internal::GlobalHandles::Node>::Free
0c Hyperdrive!v8::internal::GlobalHandles::NodeSpace<v8::internal::GlobalHandles::Node>::Release
0d Hyperdrive!v8::internal::GlobalHandles::Destroy
0e Hyperdrive!v8::PersistentBase<v8::Promise::Resolver>::Reset
0f Hyperdrive!v8::Global<v8::Promise::Resolver>::~Global
10 Hyperdrive!gin_helper::PromiseBase::~PromiseBase
11 Hyperdrive!std::__1::__tuple_leaf<1,gin_helper::Promise<gin_helper::Dictionary>,0>::~__tuple_leaf
12 Hyperdrive!std::__1::__tuple_impl<std::__1::__tuple_indices<0,1,2>,v8::Global<v8::Context>,gin_helper::Promise<gin_helper::Dictionary>,unsigned long>::~__tuple_impl
13 Hyperdrive!std::__1::tuple<v8::Global<v8::Context>,gin_helper::Promise<gin_helper::Dictionary>,unsigned long>::~tuple
14 Hyperdrive!base::internal::BindState<void (*)(v8::Global<v8::Context>, gin_helper::Promise<gin_helper::Dictionary>, unsigned long, bool, std::__1::unique_ptr<memory_instrumentation::GlobalMemoryDump,std::__1::default_delete<memory_instrumentation::GlobalMemoryDump> >),v8::Global<v8::Context>,gin_helper::Promise<gin_helper::Dictionary>,unsigned long>::~BindState
15 Hyperdrive!base::internal::BindState<void (*)(v8::Global<v8::Context>, gin_helper::Promise<gin_helper::Dictionary>, unsigned long, bool, std::__1::unique_ptr<memory_instrumentation::GlobalMemoryDump,std::__1::default_delete<memory_instrumentation::GlobalMemoryDump> >),v8::Global<v8::Context>,gin_helper::Promise<gin_helper::Dictionary>,unsigned long>::Destroy
16 Hyperdrive!std::__1::__tuple_leaf<0,base::RepeatingCallback<void (const content::ServiceWorkerVersionBaseInfo &, mojo::PendingReceiver<blink::mojom::BadgeService>)>,0>::~__tuple_leaf
17 Hyperdrive!std::__1::tuple<base::RepeatingCallback<void (const content::ServiceWorkerVersionBaseInfo &, mojo::PendingReceiver<blink::mojom::BadgeService>)> >::~tuple
18 Hyperdrive!base::internal::BindState<void (*)(const base::RepeatingCallback<void (const content::ServiceWorkerVersionBaseInfo &, mojo::PendingReceiver<blink::mojom::BadgeService>)> &, const content::ServiceWorkerVersionBaseInfo &, mojo::ScopedHandleBase<mojo::MessagePipeHandle>),base::RepeatingCallback<void (const content::ServiceWorkerVersionBaseInfo &, mojo::PendingReceiver<blink::mojom::BadgeService>)> >::~BindState
19 Hyperdrive!base::internal::BindState<void (*)(const base::RepeatingCallback<void (const content::ServiceWorkerVersionBaseInfo &, mojo::PendingReceiver<blink::mojom::BadgeService>)> &, const content::ServiceWorkerVersionBaseInfo &, mojo::ScopedHandleBase<mojo::MessagePipeHandle>),base::RepeatingCallback<void (const content::ServiceWorkerVersionBaseInfo &, mojo::PendingReceiver<blink::mojom::BadgeService>)> >::Destroy
1a Hyperdrive!memory_instrumentation::mojom::Coordinator_RequestGlobalMemoryDumpForPid_ForwardToCallback::~Coordinator_RequestGlobalMemoryDumpForPid_ForwardToCallback
1b Hyperdrive!memory_instrumentation::mojom::Coordinator_RequestGlobalMemoryDumpForPid_ForwardToCallback::~Coordinator_RequestGlobalMemoryDumpForPid_ForwardToCallback
1c Hyperdrive!std::__1::default_delete<mojo::MessageReceiver>::operator()
1d Hyperdrive!std::__1::unique_ptr<mojo::MessageReceiver,std::__1::default_delete<mojo::MessageReceiver> >::reset
1e Hyperdrive!std::__1::unique_ptr<mojo::MessageReceiver,std::__1::default_delete<mojo::MessageReceiver> >::~unique_ptr
1f Hyperdrive!std::__1::__tuple_leaf<0,std::__1::unique_ptr<mojo::MessageReceiver,std::__1::default_delete<mojo::MessageReceiver> >,0>::~__tuple_leaf
20 Hyperdrive!std::__1::__tuple_impl<std::__1::__tuple_indices<0,1>,std::__1::unique_ptr<mojo::MessageReceiver,std::__1::default_delete<mojo::MessageReceiver> >,mojo::Message>::~__tuple_impl
21 Hyperdrive!std::__1::tuple<std::__1::unique_ptr<mojo::MessageReceiver,std::__1::default_delete<mojo::MessageReceiver> >,mojo::Message>::~tuple
22 Hyperdrive!base::internal::BindState<void (*)(std::__1::unique_ptr<mojo::MessageReceiver,std::__1::default_delete<mojo::MessageReceiver> >, mojo::Message),std::__1::unique_ptr<mojo::MessageReceiver,std::__1::default_delete<mojo::MessageReceiver> >,mojo::Message>::~BindState
23 Hyperdrive!base::internal::BindState<void (*)(std::__1::unique_ptr<mojo::MessageReceiver,std::__1::default_delete<mojo::MessageReceiver> >, mojo::Message),std::__1::unique_ptr<mojo::MessageReceiver,std::__1::default_delete<mojo::MessageReceiver> >,mojo::Message>::Destroy
24 Hyperdrive!base::sequence_manager::internal::LazilyDeallocatedDeque<base::sequence_manager::Task,&base::subtle::TimeTicksNowIgnoringOverride>::Ring::pop_front
25 Hyperdrive!base::sequence_manager::internal::LazilyDeallocatedDeque<base::sequence_manager::Task,&base::subtle::TimeTicksNowIgnoringOverride>::Ring::~Ring
26 Hyperdrive!std::__1::default_delete<base::sequence_manager::internal::LazilyDeallocatedDeque<base::sequence_manager::Task,&base::subtle::TimeTicksNowIgnoringOverride>::Ring>::operator()
27 Hyperdrive!std::__1::unique_ptr<base::sequence_manager::internal::LazilyDeallocatedDeque<base::sequence_manager::Task,&base::subtle::TimeTicksNowIgnoringOverride>::Ring,std::__1::default_delete<base::sequence_manager::internal::LazilyDeallocatedDeque<base::sequence_manager::Task,&base::subtle::TimeTicksNowIgnoringOverride>::Ring> >::reset
28 Hyperdrive!std::__1::unique_ptr<base::sequence_manager::internal::LazilyDeallocatedDeque<base::sequence_manager::Task,&base::subtle::TimeTicksNowIgnoringOverride>::Ring,std::__1::default_delete<base::sequence_manager::internal::LazilyDeallocatedDeque<base::sequence_manager::Task,&base::subtle::TimeTicksNowIgnoringOverride>::Ring> >::operator=
29 Hyperdrive!base::sequence_manager::internal::LazilyDeallocatedDeque<base::sequence_manager::Task,&base::subtle::TimeTicksNowIgnoringOverride>::clear
2a Hyperdrive!base::sequence_manager::internal::LazilyDeallocatedDeque<base::sequence_manager::Task,&base::subtle::TimeTicksNowIgnoringOverride>::~LazilyDeallocatedDeque
2b Hyperdrive!base::sequence_manager::internal::TaskQueueImpl::UnregisterTaskQueue
2c Hyperdrive!base::sequence_manager::internal::SequenceManagerImpl::UnregisterTaskQueueImpl
2d Hyperdrive!base::sequence_manager::TaskQueue::ShutdownTaskQueue
2e Hyperdrive!content::BrowserTaskQueues::~BrowserTaskQueues
2f Hyperdrive!content::BrowserUIThreadScheduler::~BrowserUIThreadScheduler
30 Hyperdrive!std::__1::default_delete<content::BrowserUIThreadScheduler>::operator()
31 Hyperdrive!std::__1::unique_ptr<content::BrowserUIThreadScheduler,std::__1::default_delete<content::BrowserUIThreadScheduler> >::reset
32 Hyperdrive!std::__1::unique_ptr<content::BrowserUIThreadScheduler,std::__1::default_delete<content::BrowserUIThreadScheduler> >::~unique_ptr
33 Hyperdrive!content::BrowserTaskExecutor::UIThreadExecutor::~UIThreadExecutor
34 Hyperdrive!content::BrowserTaskExecutor::UIThreadExecutor::~UIThreadExecutor
35 Hyperdrive!std::__1::default_delete<content::BrowserTaskExecutor::UIThreadExecutor>::operator()
36 Hyperdrive!std::__1::unique_ptr<content::BrowserTaskExecutor::UIThreadExecutor,std::__1::default_delete<content::BrowserTaskExecutor::UIThreadExecutor> >::reset
37 Hyperdrive!content::BrowserTaskExecutor::Shutdown
38 Hyperdrive!content::ContentMainRunnerImpl::Shutdown
39 Hyperdrive!content::RunContentProcess
3a Hyperdrive!content::ContentMain
3b Hyperdrive!wWinMain
3c Hyperdrive!invoke_main
3d Hyperdrive!__scrt_common_main_seh
3e KERNEL32!BaseThreadInitThunk
3f ntdll!RtlUserThreadStart