macOS: reproducible crash in `nativeSetSubviewFrame`/`nativePresentWithInterop` when live-resizing a `DecoratedWindow` that hosts a NativeView (ComposeNativeWebview)

[martinkade]

Title

macOS: reproducible crash in nativeSetSubviewFrame/nativePresentWithInterop when live-resizing a DecoratedWindow that hosts a NativeView (ComposeNativeWebview)

Environment

• Nucleus: nucleus.nucleus-application / nucleus.decorated-window-tao 2.5.12
• dev.nucleusframework:composewebview 1.0.3
• Backend: NucleusBackend.Tao
• macOS 26.6.2 (build 25G83), Apple Silicon (arm64)
• JDK: JetBrains Runtime 21.0.10 (JBR-21.0.10+7-1163.105-jcef)
• Kotlin 2.4.10, Compose Multiplatform 1.12.0

Repro steps

1. nucleusApplication(args, backend = NucleusBackend.Tao) { DecoratedWindow(...) { TitleBar {}; /* content that mounts a ComposeNativeWebview WebView at some point */ } }
2. Run the app, let a WebView (ComposeNativeWebview) mount somewhere in the composition.
3. Grab the window's edge/corner and drag to live-resize it.
4. Crash, reproduced on 2 separate runs.

Expected

Window resizes normally; the WebView reflows with it.

Actual

The process crashes during the live-resize drag. Observed two different crash signatures from the same trigger (drag-resize while a WebView/NativeView is mounted), both bottoming out in the same native frames:

Java_dev_nucleusframework_window_tao_ffi_NativeTaoMacOsNativeViewBridge_nativeSetSubviewFrame
  <- Java_dev_nucleusframework_window_tao_ffi_NativeMetalBridge_nativePresentWithInterop
  <- ... CFRunLoop ...
  <- -[NSWindow(NSWindowResizing) _resizeWithEvent:]
  <- -[NSThemeFrame attemptResizeWithEvent:] / handleMouseDown:
  <- -[NSWindow(NSEventRouting) sendEvent:] (via libnucleus_tao.dylib)

Crash 1 - SIGSEGV in objc_retain

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x000000018b6e791c, pid=3259, tid=259
#
# JRE version: OpenJDK Runtime Environment JBR-21.0.10+7-1163.105-jcef (21.0.10+7)
# Java VM: OpenJDK 64-Bit Server VM JBR-21.0.10+7-1163.105-jcef (21.0.10+7-b1163.105, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, bsd-aarch64)
# Problematic frame:
# C  [libobjc.A.dylib+0x791c]  objc_retain+0x10
#

Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  [libobjc.A.dylib+0x791c]  objc_retain+0x10
C  [libnucleus_tao_macos_native_view.dylib+0x1724]  Java_dev_nucleusframework_window_tao_ffi_NativeTaoMacOsNativeViewBridge_nativeSetSubviewFrame+0x4c
J 9383  dev.nucleusframework.window.tao.ffi.NativeTaoMacOsNativeViewBridge.nativeSetSubviewFrame(JJIIII)V (0 bytes) @ 0x0000000119ef94f8 [0x0000000119ef9440+0x00000000000000b8]
J 11039 c1 dev.nucleusframework.window.tao.scene.TaoComposeSceneHost$nativeViewHost$1.setFrame$lambda$0(Ldev/nucleusframework/window/tao/scene/TaoComposeSceneHost;JIIII)Lkotlin/Unit; (19 bytes) @ 0x00000001133d67dc [0x00000001133d6740+0x000000000000009c]
J 11038 c1 dev.nucleusframework.window.tao.scene.TaoComposeSceneHost$nativeViewHost$1$$Lambda+0x00000070025e3a58.invoke()Ljava/lang/Object; (28 bytes) @ 0x00000001133d642c [0x00000001133d6340+0x00000000000000ec]
j  dev.nucleusframework.window.tao.scene.TaoInteropTransaction.performTransaction()V+32
J 11034 c1 dev.nucleusframework.window.tao.scene.TaoComposeSceneHost$renderFrameSuspending$2$$Lambda+0x00000070025ee348.run()V (12 bytes) @ 0x00000001133d4394 [0x00000001133d4200+0x0000000000000194]
v  ~StubRoutines::call_stub 0x00000001194c0154
V  [libjvm.dylib+0x4b2afc]  JavaCalls::call_helper(JavaValue*, methodHandle const&, JavaCallArguments*, JavaThread*)+0x3d8
V  [libjvm.dylib+0x51ebd0]  jni_invoke_nonstatic(JNIEnv_*, JavaValue*, _jobject*, JNICallType, _jmethodID*, JNI_ArgumentPusher*, JavaThread*)+0x3d0
V  [libjvm.dylib+0x5233e8]  jni_CallVoidMethod+0x110
C  [libnucleus_tao_metal.dylib+0x71a8]  Java_dev_nucleusframework_window_tao_ffi_NativeMetalBridge_nativePresentWithInterop+0x324
C  [libnucleus_tao_metal.dylib+0x7234]  Java_dev_nucleusframework_window_tao_ffi_NativeMetalBridge_nativePresentWithInterop+0x3b0
C  [CoreFoundation+0x7db00]  __CFRUNLOOP_IS_CALLING_OUT_TO_A_BLOCK__+0x1c
C  [CoreFoundation+0x7da40]  __CFRunLoopDoBlocks+0x18c
C  [CoreFoundation+0x7ce84]  __CFRunLoopRun+0x934
C  [CoreFoundation+0x14f264]  _CFRunLoopRunSpecificWithOptions+0x214
C  [HIToolbox+0xbd560]  RunCurrentEventLoopInMode+0x140
C  [HIToolbox+0xc08bc]  ReceiveNextEventCommon+0x1e8
C  [HIToolbox+0x24a14c]  _BlockUntilNextEventMatchingListInMode+0x30
C  [AppKit+0x6e53d0]  _DPSBlockUntilNextEventMatchingListInMode+0xe4
C  [AppKit+0x39084]  _DPSNextEvent+0x240
C  [AppKit+0xbce96c]  -[NSApplication(NSEventRouting) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]+0x2b0
C  [AppKit+0xbce678]  -[NSApplication(NSEventRouting) nextEventMatchingMask:untilDate:inMode:dequeue:]+0x48
C  [AppKit+0x3068ec]  -[NSWindow(NSWindowResizing) _resizeWithEvent:]+0x280
C  [AppKit+0x228eec]  -[NSTitledFrame attemptResizeWithEvent:]+0x9c
C  [AppKit+0x228d00]  -[NSThemeFrame handleMouseDown:]+0xc4
C  [AppKit+0x29ddf8]  -[NSThemeFrame mouseDown:]+0x20
C  [AppKit+0x1cec64]  -[NSWindow(NSEventRouting) _handleMouseDownEvent:isDelayedEvent:]+0xe70

Crash 2 - NSInvalidArgumentException, different run, same trigger

*** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '-[OS_dispatch_mach_msg superview]: unrecognized selector sent to instance 0x949908000'
*** First throw call stack:
(
	0   CoreFoundation                      0x000000018bc7f1f0 __exceptionPreprocess + 176
	1   libobjc.A.dylib                     0x000000018b6fa91c objc_exception_throw + 88
	2   CoreFoundation                      0x000000018bd403b4 -[NSObject(NSObject) __retain_OA] + 0
	3   CoreFoundation                      0x000000018bbeff68 ___forwarding___ + 1480
	4   CoreFoundation                      0x000000018bbef8e0 _CF_forwarding_prep_0 + 96
	5   libnucleus_tao_macos_native_view.dy 0x00000001328f179c Java_dev_nucleusframework_window_tao_ffi_NativeTaoMacOsNativeViewBridge_nativeSetSubviewFrame + 196
	...
	14  libjvm.dylib                        0x000000010ce2aafc _ZN9JavaCalls11call_helperEP9JavaValueRK12methodHandleP17JavaCallArgumentsP10JavaThread + 984
	17  libnucleus_tao_metal.dylib          0x0000000129f231a8 Java_dev_nucleusframework_window_tao_ffi_NativeMetalBridge_nativePresentWithInterop + 804
	30  AppKit                              0x00000001903138ec -[NSWindow(NSWindowResizing) _resizeWithEvent:] + 640
	31  AppKit                              0x0000000190235eec -[NSTitledFrame attemptResizeWithEvent:] + 156
	32  AppKit                              0x0000000190235d00 -[NSThemeFrame handleMouseDown:] + 196
	...
)
libc++abi: terminating due to uncaught exception of type NSException

Note the -[OS_dispatch_mach_msg superview]: unrecognized selector message - superview is being sent to what's actually a GCD dispatch object, not an NSView. That, together with the objc_retain SIGSEGV from the other run, points at a stale/dangling pointer being read as an NSView* inside nativeSetSubviewFrame specifically under resize-driven nativePresentWithInterop re-entrancy, rather than two unrelated bugs.

Notes / possibly related

• #496 ("overlay-safe detach and set_focusable retain leak on macOS") and #101 ("prevent objc_retain crash on freed NSWindow during disposal") are in the same area (macOS NativeView retain/lifetime handling) and are both already included in 2.5.12, so they don't look like the same bug - but they suggest this general area (native-view frame/retain handling on macOS) has had recurring issues.
• #638/#641 ("cap and reclaim the Skia GPU resource cache on the Metal ... host") is open as of 2026-09-04 and explicitly scoped "Windows-only today" for the macOS Metal host, so macOS resize handling in that area is acknowledged as incomplete - possibly related given nativePresentWithInterop is in both traces.