From c445aebb35302188811f130fb3001ff6300daaee Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Wed, 4 Nov 2026 23:27:39 -0800
Subject: [PATCH 1/4] chore(quest): claim quest/m0/browser-first-crash.md

Quest-Claim: e8c9d494441c8465

From f7beb6119c6932196b602e76dd00f4ef9ec25e53 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Wed, 4 Nov 2026 23:46:59 -0800
Subject: [PATCH 2/4] fix(scene): a browser page that crashes while loading
 fails at once

A renderer killed by chrome://crash on its first navigation stayed Starting
past the test's budget on NixOS. CEF does report it, but only once the
process is gone, and systemd-coredump took 20 to 70 seconds to dump the
crashed renderer first. The helper now sets its core dump limit to zero
before CEF starts, which CEF's subprocesses inherit, so the crash reaches
the studio within milliseconds.

The crash test splits in two: a renderer that crashes during its first
navigation, and one aborted after the page has drawn.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                        |   1 +
 quest/m0/README.md               |   1 -
 quest/m0/browser-first-crash.md  |  22 ------
 rs/moq-scene/src/browser/host.rs |  15 +++++
 rs/moq-studio/tests/browser.rs   | 112 ++++++++++++++++++++++++++-----
 5 files changed, 112 insertions(+), 39 deletions(-)
 delete mode 100644 quest/m0/browser-first-crash.md

diff --git a/README.md b/README.md
index e5a3f4a..e48b9b5 100644
--- a/README.md
+++ b/README.md
@@ -203,6 +203,7 @@ a restart of the studio. One studio at a time can use it: a second one's
 browser sources fail saying so. Each page renders in a process of its own, so
 a page that crashes fails only its own source, with the reason, while the
 stream carries on. A crash of the browser itself fails every browser source.
+Either shows at once, since the browser's processes dump no core.
 **Reload** in Sources restarts a page, failed or not. A page's dropdown
 lists, such as a `<select>`'s, draw over it and take clicks under
 **Interact**, but it opens no other windows (`window.open` and new-tab links
diff --git a/quest/m0/README.md b/quest/m0/README.md
index eb29ff6..22d3b9d 100644
--- a/quest/m0/README.md
+++ b/quest/m0/README.md
@@ -108,7 +108,6 @@ repository.
 - [Recover crashed recordings](/quest/m0/recording-repair.md) - a recording a crash left unfinished is repaired beside the original at launch
 - [Premultiplied source sampling](/quest/m0/premultiply.md) - scaled transparent sources draw without edge fringes
 - [Deterministic browser source startup](/quest/m0/cef-startup.md) - CEF on the CPU path paints its first frame without the GPU fallback hang
-- [A browser renderer that dies on its first page](/quest/m0/browser-first-crash.md) - a renderer lost during the first navigation fails its source
 - [Signing identities are available](/quest/m0/signing.md) - the Apple and Windows code-signing credentials packaging and the macOS camera need
 - [Packaging](/quest/m0/packaging.md) - signed installers for macOS and Windows and a Flatpak for Linux
 - [The persistable portal restore token is pinned](/quest/m0/pin-portal-token.md) - moq-video's restore token, for Wayland sources
diff --git a/quest/m0/browser-first-crash.md b/quest/m0/browser-first-crash.md
deleted file mode 100644
index a02d1a0..0000000
--- a/quest/m0/browser-first-crash.md
+++ /dev/null
@@ -1,22 +0,0 @@
-# [S] A browser renderer that dies on its first page
-
-## Goal
-
-A browser source whose renderer dies during its first navigation shows as
-failed, as one that crashes later does, instead of staying Starting forever.
-`a_crash_drops_only_its_source` passes on NixOS as well as Ubuntu.
-
-## Plan
-
-From [moq-dev/studio#8](https://github.com/moq-dev/studio/pull/8) and
-[moq-dev/studio#29](https://github.com/moq-dev/studio/pull/29).
-
-- A renderer crashed by `chrome://crash` as the first URL fires neither
-  `on_render_process_terminated` (`rs/moq-scene/src/browser/host.rs`) nor
-  `on_load_error`, so the page stays Starting. Checked with debug prints on
-  #29.
-- Find the signal CEF does give for it (for example the browser's process
-  exit or a load that never commits) and fail the source on it, without a
-  timeout: fail loud on an observed event.
-- Split the test: one crash during the first navigation, and one after the
-  page commits.
diff --git a/rs/moq-scene/src/browser/host.rs b/rs/moq-scene/src/browser/host.rs
index 9c20ec7..9afe580 100644
--- a/rs/moq-scene/src/browser/host.rs
+++ b/rs/moq-scene/src/browser/host.rs
@@ -11,6 +11,7 @@ use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Mutex, mpsc};
 
 use cef::*;
+use rustix::process::{Resource, Rlimit, getrlimit, setrlimit};
 
 use super::outbox::Commands;
 use super::protocol::{Area, Channel, Command, Event, Format, Id, Layer, Open, Plane, Start, Texture};
@@ -110,6 +111,20 @@ fn serve() -> Result<(), String> {
 /// Run CEF on the profile `start` names, opening and closing pages as the
 /// studio asks, until it closes the socket and the last page closes.
 fn browse(shared: &Arc<Shared>, start: Start, reader: Channel, painted_tx: mpsc::Sender<()>) -> Result<(), String> {
+	// A crashed process is reported only once it is gone, and one dumping
+	// core is not gone yet: systemd-coredump took 20 to 70 seconds over a
+	// renderer, which left its page Starting meanwhile. CEF's subprocesses
+	// inherit the limit, so none of them dumps core.
+	let core = getrlimit(Resource::Core);
+	setrlimit(
+		Resource::Core,
+		Rlimit {
+			current: Some(0),
+			maximum: core.maximum,
+		},
+	)
+	.map_err(|err| format!("cannot turn off core dumps: {err}"))?;
+
 	let _ = api_hash(sys::CEF_API_VERSION_LAST, 0);
 	let args = args::Args::new();
 	let mut app = HelperApp::new(HelperProcess::new(), start.render_node);
diff --git a/rs/moq-studio/tests/browser.rs b/rs/moq-studio/tests/browser.rs
index 2a1af49..0f423b0 100644
--- a/rs/moq-studio/tests/browser.rs
+++ b/rs/moq-studio/tests/browser.rs
@@ -323,12 +323,12 @@ async fn a_page_that_closes_itself_fails_alone() {
 	.await;
 }
 
-/// A page whose renderer crashes fails its own source and leaves the canvas,
-/// while everything else keeps drawing. A crash of the helper every page
-/// shares fails them all and nothing else, and a reload starts a new one.
+/// A page whose renderer crashes on its first navigation fails its own
+/// source, while everything else keeps drawing. A crash of the helper every
+/// page shares fails them all and nothing else, and a reload starts a new one.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "needs CEF and a Vulkan device; run by just render-sw"]
-async fn a_crash_drops_only_its_source() {
+async fn a_crash_while_loading_drops_only_its_source() {
 	local(async {
 		let crash = Source::Browser {
 			url: "chrome://crash".into(),
@@ -359,6 +359,38 @@ async fn a_crash_drops_only_its_source() {
 	.await;
 }
 
+/// A page whose renderer crashes after it has drawn fails its source and
+/// leaves the canvas, and a reload draws it again.
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "needs CEF and a Vulkan device; run by just render-sw"]
+async fn a_crash_after_drawing_leaves_the_canvas() {
+	local(async {
+		let red = page("<body style='background:red'></body>");
+		let mut studio = Studio::new(&[("blue", blue()), ("page", red)]).await;
+		studio.until_center([255, 0, 0, 255], &[]).await;
+
+		// Abort the page's renderer, and any spare one CEF keeps ready, which
+		// shows no page, as a failed assertion would: a crash that dumps core.
+		// (V8 takes a SIGSEGV that no fault raised and carries on.)
+		let helper = helper().expect("the page's helper is running");
+		let renderers = renderers(helper);
+		assert!(!renderers.is_empty(), "the page has a renderer");
+		for renderer in renderers {
+			let crashed = std::process::Command::new("kill")
+				.args(["-ABRT", &renderer.to_string()])
+				.status();
+			assert!(crashed.unwrap().success());
+		}
+		let reason = studio.until_failed("page").await;
+		assert!(reason.contains("renderer"), "{reason}");
+		studio.until_center(BLUE, &["page"]).await;
+
+		studio.reload("page");
+		studio.until_center([255, 0, 0, 255], &[]).await;
+	})
+	.await;
+}
+
 /// Cookies, even one without an expiry, survive a reload of the page and a
 /// restart of the studio, since every page keeps them in one profile on disk.
 /// A second studio on the profile while it is in use fails its pages saying
@@ -437,16 +469,64 @@ async fn serve(html: &'static str) -> String {
 /// The one helper this test process still runs: a child started with the
 /// helper's argument.
 fn helper() -> Option<u32> {
-	let ours = std::process::id().to_string();
-	std::fs::read_dir("/proc").ok()?.flatten().find_map(|entry| {
-		let pid: u32 = entry.file_name().to_str()?.parse().ok()?;
-		let stat = std::fs::read_to_string(entry.path().join("stat")).ok()?;
-		// The parent is the second field after the parenthesized command.
-		let parent = stat.rsplit_once(')')?.1.split_whitespace().nth(1)?;
-		let cmdline = std::fs::read(entry.path().join("cmdline")).ok()?;
-		let helper = cmdline
-			.split(|byte| *byte == 0)
-			.any(|arg| arg == b"--moq-browser-helper");
-		(parent == ours && helper).then_some(pid)
-	})
+	let ours = std::process::id();
+	processes()
+		.into_iter()
+		.find(|process| process.parent == ours && process.args.iter().any(|arg| arg == b"--moq-browser-helper"))
+		.map(|process| process.pid)
+}
+
+/// The renderers under `helper`. CEF forks them from its zygote, whose
+/// arguments they keep, so they are told apart by the compositor thread every
+/// renderer runs.
+fn renderers(helper: u32) -> Vec<u32> {
+	let processes = processes();
+	let mut family = vec![helper];
+	let mut at = 0;
+	while let Some(&parent) = family.get(at) {
+		family.extend(
+			processes
+				.iter()
+				.filter(|process| process.parent == parent)
+				.map(|process| process.pid),
+		);
+		at += 1;
+	}
+	family
+		.into_iter()
+		.filter(|pid| {
+			let threads = std::fs::read_dir(format!("/proc/{pid}/task"))
+				.into_iter()
+				.flatten()
+				.flatten();
+			threads
+				.filter_map(|thread| std::fs::read_to_string(thread.path().join("comm")).ok())
+				.any(|name| name.trim_end() == "Compositor")
+		})
+		.collect()
+}
+
+struct Process {
+	pid: u32,
+	parent: u32,
+	args: Vec<Vec<u8>>,
+}
+
+/// Every process running.
+fn processes() -> Vec<Process> {
+	let Ok(entries) = std::fs::read_dir("/proc") else {
+		return Vec::new();
+	};
+	entries
+		.flatten()
+		.filter_map(|entry| {
+			let pid = entry.file_name().to_str()?.parse().ok()?;
+			let stat = std::fs::read_to_string(entry.path().join("stat")).ok()?;
+			// The parent is the second field after the parenthesized command.
+			let parent = stat.rsplit_once(')')?.1.split_whitespace().nth(1)?.parse().ok()?;
+			let cmdline = std::fs::read(entry.path().join("cmdline")).ok()?;
+			let args = cmdline.split(|byte| *byte == 0).map(<[u8]>::to_vec).collect();
+			Some(Process { pid, parent, args })
+		})
+		.collect()
 }

From 09e5b25dfa0d3df839c1a54b07c722c5ac83de0e Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 06:43:48 -0800
Subject: [PATCH 3/4] fix(scene): skip piped core handlers too, with a soft
 core limit of 1

The kernel ignores RLIMIT_CORE for a pipe core_pattern, so a handler that
reads the core regardless (Apport, a custom one) could still hold a crashed
renderer for a minute. At exactly 1 the kernel skips the handler itself.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 rs/moq-scene/src/browser/host.rs | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/rs/moq-scene/src/browser/host.rs b/rs/moq-scene/src/browser/host.rs
index 9afe580..16c6cde 100644
--- a/rs/moq-scene/src/browser/host.rs
+++ b/rs/moq-scene/src/browser/host.rs
@@ -114,12 +114,15 @@ fn browse(shared: &Arc<Shared>, start: Start, reader: Channel, painted_tx: mpsc:
 	// A crashed process is reported only once it is gone, and one dumping
 	// core is not gone yet: systemd-coredump took 20 to 70 seconds over a
 	// renderer, which left its page Starting meanwhile. CEF's subprocesses
-	// inherit the limit, so none of them dumps core.
+	// inherit the limit. 1, not 0: the kernel ignores the limit for a pipe
+	// core_pattern (systemd-coredump, Apport) except at 1, where it skips the
+	// handler, and a core file needs a page. A hard limit of 0 forbids 1, so
+	// a pipe handler then dumps unless it honours the 0 it is passed.
 	let core = getrlimit(Resource::Core);
 	setrlimit(
 		Resource::Core,
 		Rlimit {
-			current: Some(0),
+			current: Some(core.maximum.map_or(1, |maximum| maximum.min(1))),
 			maximum: core.maximum,
 		},
 	)

From a06dd0aa3469f0517b4637525d69f3cf6a3d91c3 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Thu, 5 Nov 2026 07:06:34 -0800
Subject: [PATCH 4/4] docs(scene): a socket core_pattern relies on the handler
 too

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 rs/moq-scene/src/browser/host.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/rs/moq-scene/src/browser/host.rs b/rs/moq-scene/src/browser/host.rs
index 16c6cde..7f3f25d 100644
--- a/rs/moq-scene/src/browser/host.rs
+++ b/rs/moq-scene/src/browser/host.rs
@@ -116,8 +116,9 @@ fn browse(shared: &Arc<Shared>, start: Start, reader: Channel, painted_tx: mpsc:
 	// renderer, which left its page Starting meanwhile. CEF's subprocesses
 	// inherit the limit. 1, not 0: the kernel ignores the limit for a pipe
 	// core_pattern (systemd-coredump, Apport) except at 1, where it skips the
-	// handler, and a core file needs a page. A hard limit of 0 forbids 1, so
-	// a pipe handler then dumps unless it honours the 0 it is passed.
+	// handler, and a core file needs a page. A socket core_pattern (`@`), or
+	// a pipe under a hard limit of 0, which forbids 1, relies instead on the
+	// handler honouring the limit, as systemd-coredump does.
 	let core = getrlimit(Resource::Core);
 	setrlimit(
 		Resource::Core,