fix(macos): recover when WebKit abandons its GPU process at launch - #3342

…nning

WebKit gives its GPU process 3 s to answer a page. When the process misses
that, WebKit stops tracking it and asks launchd to kill it, and macOS
refuses the kill (WebKit bug 324797). The page stays connected to the
dropped process and never paints. At login, when the GPU process is slow to
start, Buzz opens to a window that stays empty until it is quit.

A new macOS-only module, installed from setup beside reshow, watches for
this. A one-second main-thread timer reads the main webview's private
_gpuProcessIdentifier and records each reported process with its start
time. A recorded process that goes unreported for two checks, and is still
the same process running the WebKit GPU binary, gets SIGKILL. A process
that WebKit shut down exits within that time and is forgotten instead. Each
kill, and each failed kill, is logged. If the webview lacks the selector,
no timer is installed. A process the timer never saw reported is never
killed, and a failed kill is not retried.

The decision function is compiled for tests on every platform, so the
Linux and Windows CI suites run its tests. The timer, the selector call
and the kill are macOS-only. objc2-foundation gains the NSDate and NSTimer
features; Cargo.lock is unchanged.

Verified on macOS 27.2:
- The seven unit tests pass: six for the decision function, and one that
  reads the identity of a `sleep` child the test starts, kills it through
  the module's own kill, and checks the identity is then gone.
- Setting the grace to one check fails four of them, and skipping the
  still-running check fails two.
- clippy --all-targets -D warnings is clean for the crate. The file also
  compiles warning-free and passes with the macOS parts compiled out,
  using rustc directly, not the Linux or Windows toolchain.
- Read-only: WKWebView has _gpuProcessIdentifier and it returns an int.
  The identity read returns a start time for this user's running WebKit
  GPU processes, including a suspended one. None of them was signalled.

Not verified at runtime:
- No Buzz build was launched. The install path, the timer, the selector
  call on a live webview and a real kill have not run inside Buzz.
- That WebKit starts a new GPU process and the page paints after the kill
  was measured earlier in a standalone test app, not in Buzz.
- Whether the timer keeps its one-second rate while the launch window is
  still hidden. A throttled timer could miss the roughly four seconds in
  which WebKit reports the process, and then nothing is killed.
- Killing from the hardened, Developer ID signed build.

Signed-off-by: Matt Toohey <[email protected]>
Co-Authored-By: Claude Fable 5.2 <[email protected]>
Signed-off-by: Matt Toohey <[email protected]>

The watcher took a main webview that reports no GPU process as proof that
WebKit had dropped it. WebKit also reports none whenever the webview has
no running content process, while it keeps using the same GPU process for
the app's other webviews. A crash of the main webview's content process
that is not reloaded at once would have looked like a dropped GPU process,
and after two checks Buzz would have killed the healthy one. Only Tauri's
default handler, which reloads inside the termination callback, kept the
timer from seeing that state.

Each check now also reads the webview's private _webProcessIdentifier.
While it is 0 the check is skipped: nothing is recorded, counted towards
the grace, or killed. The decision is a new `check` function, compiled for
tests on every platform like the one it calls. The timer is not installed
unless the webview has both selectors.

A check is also skipped while the content process is still launching,
because its pid is 0 until then. WebKit's 3 s wait is run by a launched
content process, so the hang is still seen.

Verified on macOS 27.2:
- The eight unit tests pass. The new one keeps a recorded GPU process
  running through five checks without a content process and expects no
  kill, then expects the kill after two checks with one. It fails with the
  skip removed.
- clippy --all-targets -D warnings is clean for the crate. The file also
  compiles warning-free and its seven portable tests pass with the macOS
  parts compiled out, using rustc directly, not the Linux or Windows
  toolchain.
- In a standalone two-webview app, one webview's content process was
  killed and not reloaded. That webview reported 0 for both processes on
  five consecutive checks, while the other kept reporting the same running
  GPU process. After a reload it reported both again.
- In a standalone app whose own GPU process was stopped at launch, over
  three runs, the content process pid was 0 when the GPU process first
  appeared and nonzero 50 ms later. It stayed nonzero for the 3 s that
  WebKit reported the stopped process and after WebKit dropped it. With
  the GPU process stopped 4 s after launch instead, the first webview's
  content process pid was nonzero at every reading.

Not verified at runtime:
- No Buzz build was launched and the installed Buzz was not touched. The
  new selector call has not run on Buzz's live webview.
- A content process crash inside Buzz, with or without Tauri's reload.
- Everything the previous commit lists as unverified still is.

Signed-off-by: Matt Toohey <[email protected]>
Co-Authored-By: Claude Fable 5.2 <[email protected]>
Signed-off-by: Matt Toohey <[email protected]>

The watcher reported a kill, a refused kill and its two install failures
with eprintln! only. An app opened from Finder, the Dock or at login has
standard error on /dev/null, and Buzz's native code has no other log. A
kill that macOS refused left nothing to find, so it could not be told
apart from a watcher that never saw the process.

A new `log` helper in the macOS half of gpu_reaper.rs keeps the eprintln!
and also calls libc::syslog at notice level, which the unified log keeps
at its default level. The four messages go through it with their text
unchanged. Each carries at most a pid and an OS error. No dependency is
added, and the decision functions and their tests are untouched.

Read the messages back with:

  log show --last 30m --predicate \
    'process == "Buzz" AND eventMessage CONTAINS "GPU process"'

Verified on macOS 27.2:
- The eight unit tests pass. The one that kills a child it starts now
  goes through the helper. Its "Killed WebKit GPU process" line was read
  back from the unified log at default level, under the test binary's
  process name.
- clippy --all-targets -D warnings is clean for the crate, and rustfmt
  --check passes for the file.
- One run of a release build of this change, ad-hoc signed with the
  hardened runtime and the app's entitlements. It was launched in the
  background through LaunchServices with `open -g`, under a throwaway
  home, keychain and bundle identifier, and its own GPU process was
  stopped 0.2 s after it appeared. WebKit logged
  GPUProcessProxy::didBecomeUnresponsive and its own kill was refused.
  1.77 s later the unified log held the watcher's "Killed WebKit GPU
  process" line for that pid, under process "Buzz" at default level.
  launchd's "exited due to SIGKILL | sent by Buzz" line followed 6 ms
  later, and a new GPU process was running. The window never came to the
  front, and the installed Buzz was not signalled.

Not verified:
- The "Could not kill" line from Buzz. No kill was refused in any run.
  The same syslog call with an "Operation not permitted" text was read
  back earlier from a standalone hardened-runtime binary, not from Buzz.
- The two install-failure messages. Neither condition occurred.
- A launch with standard error discarded. The test launch captured
  stderr to a file, and the syslog call does not depend on it.
- A bundled, Developer ID signed, notarized build. The test app was a
  wrapper bundle whose executable starts the unbundled release binary.
- How long the unified log keeps the lines. They were read back within a
  minute.
- The Linux and Windows builds were not re-run. The change is confined
  to the macOS-only module.

Signed-off-by: Matt Toohey <[email protected]>
Co-Authored-By: Claude Fable 5.2 <[email protected]>
Signed-off-by: Matt Toohey <[email protected]>