Isolate browser WebKit process pools

Sources/Panels/BrowserPanel.swift

@@ -2483,7 +2483,7 @@ actor BrowserSearchSuggestionService {
 }
 
 /// BrowserPanel provides a WKWebView-based browser panel.
-/// All browser panels share a WKProcessPool for cookie sharing.
+/// Each browser panel owns a WKProcessPool so WebContent crashes stay isolated.
 private enum BrowserInsecureHTTPNavigationIntent {
     case currentTab
     case newTab
@@ -2853,9 +2853,6 @@ final class BrowserPortalAnchorView: NSView {
 
 @MainActor
 final class BrowserPanel: Panel, ObservableObject {
-    /// Shared process pool for cookie sharing across all browser panels
-    private static let sharedProcessPool = WKProcessPool()
-
     /// Popup windows owned by this panel (for lifecycle cleanup)
     private var popupControllers: [BrowserPopupWindowController] = []
 
@@ -3004,11 +3001,15 @@ final class BrowserPanel: Panel, ObservableObject {
     /// The underlying web view
     private(set) var webView: WKWebView
     private var websiteDataStore: WKWebsiteDataStore
+    /// Isolate WebKit crashes to this browser panel while keeping popups in the same browsing context.
+    private let processPool: WKProcessPool
     var webViewDidRequestClose: (() -> Void)?
 
     /// Monotonic identity for the current WKWebView instance.
     /// Incremented whenever we replace the underlying WKWebView after a process crash.
     @Published private(set) var webViewInstanceID: UUID = UUID()
+    @Published private(set) var hasRecoverableWebContentTermination = false
+    private var pendingWebContentRecoveryURL: URL?
 
     /// Prevent the omnibar from auto-focusing for a short window after explicit programmatic focus.
     /// This avoids races where SwiftUI focus state steals first responder back from WebKit.
@@ -3646,7 +3647,8 @@ final class BrowserPanel: Panel, ObservableObject {
 
         let replacement = Self.makeWebView(
             profileID: profileID,
-            websiteDataStore: websiteDataStore
+            websiteDataStore: websiteDataStore,
+            processPool: processPool
         )
         replacement.pageZoom = desiredZoom
         webViewInstanceID = UUID()
@@ -3884,12 +3886,14 @@ final class BrowserPanel: Panel, ObservableObject {
 
     private static func makeWebView(
         profileID: UUID,
-        websiteDataStore: WKWebsiteDataStore? = nil
+        websiteDataStore: WKWebsiteDataStore? = nil,
+        processPool: WKProcessPool
     ) -> CmuxWebView {
         let config = WKWebViewConfiguration()
         configureWebViewConfiguration(
             config,
-            websiteDataStore: websiteDataStore ?? BrowserProfileStore.shared.websiteDataStore(for: profileID)
+            websiteDataStore: websiteDataStore ?? BrowserProfileStore.shared.websiteDataStore(for: profileID),
+            processPool: processPool
         )
 
         let webView = CmuxWebView(frame: .zero, configuration: config)
@@ -3909,7 +3913,7 @@ final class BrowserPanel: Panel, ObservableObject {
     static func configureWebViewConfiguration(
         _ configuration: WKWebViewConfiguration,
         websiteDataStore: WKWebsiteDataStore,
-        processPool: WKProcessPool = BrowserPanel.sharedProcessPool
+        processPool: WKProcessPool
     ) {
         configuration.processPool = processPool
         configuration.mediaTypesRequiringUserActionForPlayback = []
@@ -4090,10 +4094,13 @@ final class BrowserPanel: Panel, ObservableObject {
         self.websiteDataStore = isRemoteWorkspace
             ? WKWebsiteDataStore(forIdentifier: remoteWebsiteDataStoreIdentifier ?? workspaceId)
             : BrowserProfileStore.shared.websiteDataStore(for: resolvedProfileID)
+        let processPool = WKProcessPool()
+        self.processPool = processPool
 
         let webView = Self.makeWebView(
             profileID: resolvedProfileID,
-            websiteDataStore: websiteDataStore
+            websiteDataStore: websiteDataStore,
+            processPool: processPool
         )
         self.webView = webView
         self.insecureHTTPAlertFactory = { NSAlert() }
@@ -4538,7 +4545,8 @@ final class BrowserPanel: Panel, ObservableObject {
 
         let replacement = Self.makeWebView(
             profileID: resolvedProfileID,
-            websiteDataStore: websiteDataStore
+            websiteDataStore: websiteDataStore,
+            processPool: processPool
         )
         replacement.pageZoom = desiredZoom
         webViewInstanceID = UUID()
@@ -4889,21 +4897,28 @@ final class BrowserPanel: Panel, ObservableObject {
         replaceWebViewPreservingState(
             from: terminatedWebView,
             websiteDataStore: websiteDataStore,
-            reason: "webcontent_process_terminated"
+            reason: "webcontent_process_terminated",
+            waitForManualRecovery: true
         )
     }
 
     private func replaceWebViewPreservingState(
         from oldWebView: WKWebView,
         websiteDataStore: WKWebsiteDataStore,
-        reason: String
+        reason: String,
+        waitForManualRecovery: Bool = false
     ) {
         guard oldWebView === webView else { return }
 
         let wasRenderable = shouldRenderWebView
-        let restoreURL = Self.remoteProxyDisplayURL(for: oldWebView.url) ?? currentURL
+        let restoreURL = Self.remoteProxyDisplayURL(for: oldWebView.url)
+            ?? currentURL
+            ?? Self.remoteProxyDisplayURL(for: navigationDelegate?.lastAttemptedURL)
+            ?? navigationDelegate?.lastAttemptedURL
+            ?? resolvedCurrentSessionHistoryURL()
         let restoreURLString = restoreURL?.absoluteString
         let shouldRestoreURL = wasRenderable && restoreURLString != nil && restoreURLString != blankURLString
+        let shouldShowManualRecovery = waitForManualRecovery && wasRenderable
         let history = sessionNavigationHistorySnapshot()
         let historyCurrentURL = preferredURLStringForOmnibar()
         let desiredZoom = max(minPageZoom, min(maxPageZoom, oldWebView.pageZoom))
@@ -4937,7 +4952,8 @@ final class BrowserPanel: Panel, ObservableObject {
 
         let replacement = Self.makeWebView(
             profileID: profileID,
-            websiteDataStore: websiteDataStore
+            websiteDataStore: websiteDataStore,
+            processPool: processPool
         )
         replacement.pageZoom = desiredZoom
         webViewInstanceID = UUID()
@@ -4957,7 +4973,15 @@ final class BrowserPanel: Panel, ObservableObject {
             )
         }
 
-        if shouldRestoreURL, let restoreURL {
+        if shouldShowManualRecovery {
+            pendingWebContentRecoveryURL = restoreURL
+            hasRecoverableWebContentTermination = true
+            refreshNavigationAvailability()
+        } else {
+            clearWebContentTerminationRecovery()
+        }
+
+        if !shouldShowManualRecovery, shouldRestoreURL, let restoreURL {
             navigateWithoutInsecureHTTPPrompt(
                 to: restoreURL,
                 recordTypedNavigation: false,
@@ -4981,6 +5005,34 @@ final class BrowserPanel: Panel, ObservableObject {
 #endif
     }
 
+    @discardableResult
+    func recoverTerminatedWebContent(reason: String = "manual") -> Bool {
+        guard hasRecoverableWebContentTermination else { return false }
+        let recoveryURL = pendingWebContentRecoveryURL
+        clearWebContentTerminationRecovery()
+#if DEBUG
+        cmuxDebugLog(
+            "browser.webcontent.recover panel=\(id.uuidString.prefix(5)) " +
+            "reason=\(reason) url=\(recoveryURL?.absoluteString ?? "nil")"
+        )
+#endif
+        guard let recoveryURL else {
+            refreshNavigationAvailability()
+            return true
+        }
+        navigateWithoutInsecureHTTPPrompt(
+            to: recoveryURL,
+            recordTypedNavigation: false,
+            preserveRestoredSessionHistory: true
+        )
+        return true
+    }
+
+    private func clearWebContentTerminationRecovery() {
+        pendingWebContentRecoveryURL = nil
+        hasRecoverableWebContentTermination = false
+    }
+
 #if DEBUG
     func debugSimulateWebContentProcessTermination() {
         replaceWebViewAfterContentProcessTermination(for: webView)
@@ -5527,6 +5579,7 @@ final class BrowserPanel: Panel, ObservableObject {
         preserveRestoredSessionHistory: Bool
     ) {
         cancelHiddenWebViewDiscard()
+        clearWebContentTerminationRecovery()
         if !preserveRestoredSessionHistory {
             abandonRestoredSessionHistoryIfNeeded()
         }
@@ -5892,7 +5945,8 @@ extension BrowserPanel {
 
         let replacement = Self.makeWebView(
             profileID: profileID,
-            websiteDataStore: websiteDataStore
+            websiteDataStore: websiteDataStore,
+            processPool: processPool
         )
         webViewInstanceID = UUID()
         webView = replacement
@@ -6114,6 +6168,9 @@ extension BrowserPanel {
 
     /// Reload the current page
     func reload() {
+        if recoverTerminatedWebContent(reason: "reload") {
+            return
+        }
         if restoreDiscardedWebViewIfNeeded(reason: "reload") {
             return
         }

Sources/Panels/BrowserPanelView.swift

@@ -654,6 +654,10 @@ struct BrowserPanelView: View {
             return
         }
 
+        if panel.recoverTerminatedWebContent(reason: "toolbarReload") {
+            return
+        }
+
         if currentEventIsCommandPointerActivation {
 #if DEBUG
             cmuxDebugLog("browser.reload.commandClickDuplicate panel=\(panel.id.uuidString.prefix(5))")
@@ -1645,10 +1649,37 @@ struct BrowserPanelView: View {
             }
         }
         .frame(maxWidth: .infinity, maxHeight: .infinity, alignment: .topLeading)
+        .overlay {
+            if panel.hasRecoverableWebContentTermination {
+                webContentRecoveryOverlay
+            }
+        }
         .layoutPriority(1)
         .zIndex(0)
     }
 
+    private var webContentRecoveryOverlay: some View {
+        ZStack {
+            Color(nsColor: browserChromeBackgroundColor)
+                .opacity(0.92)
+            Button(action: {
+                panel.recoverTerminatedWebContent(reason: "overlayButton")
+            }) {
+                Label(
+                    String(localized: "browser.error.reload", defaultValue: "Reload"),
+                    systemImage: "arrow.clockwise"
+                )
+                .font(.system(size: 13, weight: .medium))
+                .padding(.horizontal, 6)
+            }
+            .buttonStyle(.borderedProminent)
+            .controlSize(.regular)
+            .safeHelp(String(localized: "browser.reload", defaultValue: "Reload"))
+            .accessibilityIdentifier("BrowserWebContentRecoveryButton")
+        }
+        .frame(maxWidth: .infinity, maxHeight: .infinity)
+    }
+
     private func triggerFocusFlashAnimation() {
         focusFlashAnimationGeneration &+= 1
         let generation = focusFlashAnimationGeneration

Sources/Panels/BrowserPopupWindowController.swift

@@ -353,6 +353,14 @@ final class BrowserPopupWindowController: NSObject, NSWindowDelegate {
         }
     }
 
+    fileprivate func handleWebContentProcessTermination(for terminatedWebView: WKWebView) {
+        guard terminatedWebView === webView else { return }
+#if DEBUG
+        cmuxDebugLog("popup.webcontent.terminated depth=\(nestingDepth)")
+#endif
+        closePopup()
+    }
+
     fileprivate func requestNavigation(_ request: URLRequest, in webView: WKWebView) {
         guard let url = request.url else { return }
 
@@ -666,6 +674,10 @@ private class PopupNavigationDelegate: NSObject, WKNavigationDelegate {
         completionHandler(.performDefaultHandling, nil)
     }
 
+    func webViewWebContentProcessDidTerminate(_ webView: WKWebView) {
+        controller?.handleWebContentProcessTermination(for: webView)
+    }
+
     func webView(_ webView: WKWebView, navigationAction: WKNavigationAction, didBecome download: WKDownload) {
         #if DEBUG
         cmuxDebugLog("popup.download.didBecome source=navigationAction")

cmuxTests/BrowserConfigTests.swift

@@ -2809,6 +2809,22 @@ final class BrowserSessionHistoryRestoreTests: XCTestCase {
         XCTAssertEqual(panel.pageTitle, "Race A")
     }
 
+    func testBrowserPanelsUseSeparateWebContentProcessPools() {
+        let first = BrowserPanel(workspaceId: UUID())
+        let second = BrowserPanel(workspaceId: UUID())
+        defer {
+            first.close()
+            second.close()
+        }
+
+        XCTAssertFalse(
+            first.webView.configuration.processPool === second.webView.configuration.processPool
+        )
+        XCTAssertTrue(
+            first.webView.configuration.websiteDataStore === second.webView.configuration.websiteDataStore
+        )
+    }
+
     func testWebViewReplacementAfterProcessTerminationUpdatesInstanceIdentity() {
         let panel = BrowserPanel(
             workspaceId: UUID(),
@@ -2817,15 +2833,34 @@ final class BrowserSessionHistoryRestoreTests: XCTestCase {
         defer { panel.close() }
         let oldWebView = panel.webView
         let oldInstanceID = panel.webViewInstanceID
+        let oldProcessPool = oldWebView.configuration.processPool
 
         panel.debugSimulateWebContentProcessTermination()
 
         XCTAssertFalse(panel.webView === oldWebView)
         XCTAssertNotEqual(panel.webViewInstanceID, oldInstanceID)
+        XCTAssertTrue(panel.webView.configuration.processPool === oldProcessPool)
+        XCTAssertTrue(panel.hasRecoverableWebContentTermination)
         XCTAssertNotNil(panel.webView.navigationDelegate)
         XCTAssertNotNil(panel.webView.uiDelegate)
     }
 
+    func testReloadRecoversTerminatedWebView() {
+        let panel = BrowserPanel(
+            workspaceId: UUID(),
+            initialURL: URL(string: "https://example.com")
+        )
+        defer { panel.close() }
+
+        panel.debugSimulateWebContentProcessTermination()
+        XCTAssertTrue(panel.hasRecoverableWebContentTermination)
+
+        panel.reload()
+
+        XCTAssertFalse(panel.hasRecoverableWebContentTermination)
+        XCTAssertTrue(panel.shouldRenderWebView)
+    }
+
     func testWebViewReplacementPreservesEmptyNewTabRenderState() {
         let panel = BrowserPanel(workspaceId: UUID())
         defer { panel.close() }
@@ -2834,6 +2869,7 @@ final class BrowserSessionHistoryRestoreTests: XCTestCase {
         panel.debugSimulateWebContentProcessTermination()
 
         XCTAssertFalse(panel.shouldRenderWebView)
+        XCTAssertFalse(panel.hasRecoverableWebContentTermination)
     }
 
     func testResetSidebarContextClearsBrowserPanelsIntoNewTabState() throws {

cmuxTests/BrowserPanelTests.swift

@@ -409,7 +409,8 @@ final class BrowserPanelDiffViewerSchemeTests: XCTestCase {
 
         BrowserPanel.configureWebViewConfiguration(
             config,
-            websiteDataStore: .nonPersistent()
+            websiteDataStore: .nonPersistent(),
+            processPool: WKProcessPool()
         )
 
         XCTAssertNotNil(config.urlSchemeHandler(forURLScheme: CmuxDiffViewerURLSchemeHandler.scheme))

cmuxTests/GhosttyConfigTests.swift

@@ -1814,6 +1814,24 @@ final class BrowserPanelPopupContextTests: XCTestCase {
         )
     }
 
+    func testFloatingPopupClosesWhenWebContentProcessTerminates() throws {
+        let panel = BrowserPanel(workspaceId: UUID(), isRemoteWorkspace: false)
+        defer { panel.close() }
+        let popupWebView = try XCTUnwrap(
+            panel.createFloatingPopup(
+                configuration: WKWebViewConfiguration(),
+                windowFeatures: WKWindowFeatures()
+            )
+        )
+        let popupWindow = try XCTUnwrap(popupWebView.window)
+
+        popupWebView.navigationDelegate?.webViewWebContentProcessDidTerminate?(popupWebView)
+
+        XCTAssertNil(popupWebView.navigationDelegate)
+        XCTAssertNil(popupWebView.uiDelegate)
+        XCTAssertFalse(popupWindow.isVisible)
+    }
+
     func testFloatingPopupInheritsRemoteWorkspaceWebsiteDataStore() throws {
         let remoteWorkspaceId = UUID()
         let panel = BrowserPanel(