Problem: When the browser is closed during startup, we crash inside
PageHost::attach_compositor_ui_client() — on what looks like a normal
null check, but which is actually reading uninitialized memory.
Cause: A sync allocate_compositor_context_id IPC call is issued by the
PageHost constructor before ConnectionFromClient::m_page_host has been
assigned. The sync call runs inside the initializer that’s still
computing m_page_host’s value. If a peer disconnects before responding
(e.g., during shutdown), wait_for_specific_endpoint_message_impl’s
failure path drains any still-queued messages via handle_messages().
One of those is the initial ConnectToCompositor, which dispatches to
m_page_host->attach_compositor_ui_client() — but m_page_host is
uninitialized garbage at that point, so the call segfaults.
Fix: On peer EOF, stop draining queued messages from the failure path.
Re-entering arbitrary handlers from any sync IPC wait is unsafe — since
that wait can be reached from a constructor whose members are still
being initialized. Instead, call shutdown() to close the transport and
invoke die(). That exits processes cleanly via _exit(0) — achieving the
same effect the queued close_server message would’ve had.
Fixes https://github.com/LadybirdBrowser/ladybird/issues/9582
On macOS, use Mach port messaging instead of Unix domain sockets for
all IPC transport. This makes the transport capable of carrying Mach
port rights as message attachments, which is a prerequisite for sending
IOSurface handles over the main IPC channel (currently sent via a
separate out-of-band path). It also avoids the need for the FD
acknowledgement protocol that TransportSocket requires, since Mach port
right transfers are atomic in the kernel.
Three connection establishment patterns:
- Spawned helper processes (WebContent, RequestServer, etc.) use the
existing MachPortServer: the child sends its task port with a reply
port, and the parent responds with a pre-created port pair.
- Socket-bootstrapped connections (WebDriver, BrowserProcess) exchange
Mach port names over the socket, then drop the socket.
- Pre-created pairs for IPC tests and in-message transport transfer.
Attachment on macOS now wraps a MachPort instead of a file descriptor,
converting between the two via fileport_makeport()/fileport_makefd().
The LibIPC socket transport tests are disabled on macOS since they are
socket-specific.
