[shannah]

The crash

An app on agentic-app-framework v0.21.5 (webview 1.10.2) crashed on macOS after the user signed in to Okta and clicked the Jira tile, which opens Jira as an adopted popup tab. The crash report shows a message sent to a freed Objective-C object on the AppKit main thread:

• EXC_BAD_ACCESS KERN_INVALID_ADDRESS at 0x003b9d8b7e0ddce8
• x14 = 0xbdbb9d8b7e0ddcda, x15 = 0x003b9d8b7e0ddcd8, which is x14 with its pointer-authentication bits stripped. The fault address is x15 + 0x10, the method-cache read objc_msgSend does through a garbage isa.
• webview-popup-adopt-grace was alive, so a popup had been adopted.

Fix 1: an adopted tab over-released its configuration (Canvas 18)

impl_create_web_view stored the WKWebViewConfiguration WebKit passes to webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures: in child_e->config without retaining it. WebKit only lends that object for the call (+0), and the child WKWebView keeps its own copy, so the passed object is freed soon after. cocoa_destroy_engine releases e->config for every engine, so destroying an adopted tab released a freed object.

• impl_create_web_view retains the passed configuration for both ADOPT and NATIVE_WINDOW children.
• cocoa_discard_popup and the engine-owned impl_web_view_did_close path release it. The java_owned path leaves it to cocoa_destroy_engine, which releases it once.
• Canvas 18: new safeguard "An engine owns every object it releases"; Operation 8 items 2 and 4 updated.

Fix 2: a native-window popup over-released its window on window.close() (Canvas 15)

Found while testing fix 1 on a Mac. In Native window mode, a popup that calls window.close() stopped with zombies on: -[NSKVONotifying_NSWindow release]: message sent to deallocated instance. The popup NSWindow kept releasedWhenClosed at its default YES, so -close released it and the teardown released it again. It's now created with releasedWhenClosed = NO. This bug predates this PR. Canvas 15 safeguard: "The library owns the popup window (macOS)".

Fix 3: a native popup window closed with its close button is freed (Canvas 15)

Only a page's window.close() reached the teardown. A window the user closed with its own close button was never freed (before fix 2, AppKit freed the window object behind the library's back and everything else leaked), and Java never heard onPopupClosed.

• The popup's UI-delegate object also adopts NSWindowDelegate and is the popup window's delegate. Its windowWillClose: schedules the webViewDidClose: teardown on the main queue, retaining the delegate and web view across the hop. It uses dispatch_async_f because a window must not be released inside its own windowWillClose:, and cocoa_run_on_main_async would run it inline.
• webViewDidClose: clears the window's delegate before -close, so its own close doesn't re-enter. The teardown clears the "eng" association first, so whichever close path runs second does nothing.
• Canvas 15 safeguard: "A native popup is torn down once, however it closes".

Demo (WebViewAdoptPopupDemo)

• A Close tab button removes the selected adopted tab and calls dispose() on it, which is what reaches cocoa_destroy_engine. It leaves the opener tab alone.
• A fourth opener case, window.open → self-closing popup, opens a popup with a window.close() button.
• The README lists both steps. Canvas 18 Operation 10 item 3 describes them.

Testing

CI compiles the native library for macOS (arm64 and x86_64), Linux and Windows; all green on 18ddc01.

On a Mac (macOS 15.4.1, arm64), with NSZombieEnabled=YES ./run-mac-adopt-popup-demo.sh, on 18ddc01 — all passed, no crashes, no zombie messages:

• Adopt into tab: opened popups and closed them with Close tab, repeatedly.
• Adopt into tab: window.open → self-closing popup, click window.close(), then Close tab.
• Native window: window.open → self-closing popup, click window.close(). Crashed before fix 2.
• Native window: open a popup, close its window with the red close button (fix 3).
• Native window: both close paths mixed.

After merge

The fix reaches apps only after a swingwebview release, a webview-run release that shades it, and a matching bump of both pins in agentic-app-framework's pom.xml (they move in lockstep).

🤖 Generated with Claude Code

https://claude.ai/code/session_01SZMcbkZ4JwWKt4vBrjZcLY