fix(issue-62): prevent desktop WKWebView use-after-free crash with de… - #64
Open
martinkade wants to merge 1 commit into
Conversation
…layed view retirement and add L10 churn test
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…layed view retirement and add L10 churn test
The fix
view_lifecycle.m — the actual fix. nativeGetNsView hands Nucleus the WKWebView itself as the embedded NSView, and teardown dropped the last strong reference to it. It now stops the page, unparents it and clears delegates immediately, but hands the last reference to a retire list that releases it one second later on the main queue. A late nativeSetSubviewFrame then lands on an inert but live object.
WebViewDesktop.kt:323 — a second ordering bug the logs couldn't show. Compose forgets effects in reverse registration order, and the destroy() effect was registered last, so it freed the handle before NativeView's own detach ran nativeRemoveSubview on it. Moving the effect above the NativeView call inverts that to detach-then-release.
SuiteRunner.kt:720 — new case L10, a churn pane that mounts a second real WebView, resizes it every frame via withFrameNanos, and unmounts it 12 times with jittered delays.
Verification
All 71 cases pass (SUITE_FINISHED passed=true), plus :webview-compose:jvmTest and an e2e-shared compile for wasmJs/iOS/Android. I did not run the Android/iOS/Wasm suites or the Linux/Windows desktop legs — CI covers those.