Fix leaks around tab closing

[craxal]

PR 554808 exposed a bug related to closing tabs. Specifically, a call to raise the blob-container.close event never returns. Thus, any code following an awaited call won't be executed.

The underlying problem is due to the WebviewProxy disposing of a webview while it is trying to fulfill a request. A disposed webview cannot send a response, which results in a function call that never returns, as illustrated in this (simplified) diagram:

sequenceDiagram
autonumber

  box Blob extension process
    participant Blob Extension
    participant Blob Host
  end
  box Gray Explorer Process
    participant Explorer
    participant Explorer Host
  end
  box Gray Renderer Process
    participant Renderer Host
    participant Webview
    participant Panel API
  end

  Blob Extension ->> Blob Host: raise("blob-close")
  Blob Host -->> Renderer Host: request("raise", "blob-close")
  Renderer Host ->> Webview: handle("blob-close")
  Webview -->> Explorer Host: request("raise", "blob-close")
  Explorer Host ->> Explorer: handle("blob-close")
  Explorer ->> Explorer Host: execute("panel-close")
  Explorer Host -->>+ Renderer Host: request("execute", "panel-close")
  Renderer Host ->>+ Panel API: closePanel()
  Panel API ->>+ Webview: dispose()
  Webview -X Explorer: DISPOSE
  Webview -X Explorer Host: DISPOSE
  Webview ->>- Panel API: _
  Panel API ->>- Renderer Host: _
  Renderer Host --X- Explorer Host: response("execute", "panel-close")

See #7976, #7989.

[craxal]

A solution will require more careful management of a webview's lifecycle. Several details that need to be considered are:

• Outstanding requests need to be handled cleanly. The webview needs to either:
  1. Hold off on closing until all requests are fulfilled.
  2. Immediately send "error" or "timeout" responses for all outstanding requests.
  3. Allow a second or two for all outstanding requests to be fulfilled before sending "error" or "timeout" responses.
• The webview should refuse new requests and not send any new requests when closing.

[craxal]

After more investigation, I don't think the previously mentioned solution is good enough. The problem seems to be inherent with explorers trying to close themselves. The crux of the problem is that the close() panel API immediately removes the <webview> element from the DOM, which destroys its corresponding view model and renderer process (including the explorer and host). But because the request to close came from the explorer itself, it doesn't get a chance to respond.

To solve this problem we can do the following:

• Panel management code should not destroy any <webview> elements immediately. Rather, it sends a "close" lifecycle event to the <webview> element to signal that it needs to clean up.
• When a <webview> receives this event, it should refuse new requests and resolve open requests by waiting for responses. It could choose to timeout on open requests.
• Once all requests are resolved, the <webview> sends a message back to the parent process to signal that it is done cleaning up.
• When the panel management code receives this event, then it can destroy the <webview>.