fix: harden ghost clear race and aggressive webview reuse safety

commit: 8e7fa596047db9da67f3b4b154296baf72762d99
author: brice · 8mo ago · 2026-02-07 08:41 UTC
parent: 162a4b9
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +14 -2

M internal/infrastructure/webkit/pool.go +3 -1


@@ -519,7 +519,9 @@ func (p WebViewPool) shouldReuseOnRelease(wv WebView) bool {
519	519		case reusePolicySafe:
520	520		return !wv.HasNavigationActivity()
521	521		case reusePolicyAggressive:
522		-	return true
	522	+	// Even in aggressive mode, avoid reusing views that already navigated.
	523	+	// Reusing navigated views can leak back/forward/page context across tabs.
	524	+	return !wv.HasNavigationActivity()
523	525		default:
524	526		return false
525	527		}

 	case reusePolicySafe:
 		return !wv.HasNavigationActivity()
 	case reusePolicyAggressive:
-		return true
+		// Even in aggressive mode, avoid reusing views that already navigated.
+		// Reusing navigated views can leak back/forward/page context across tabs.
+		return !wv.HasNavigationActivity()
 	default:
 		return false
 	}

M internal/ui/component/omnibox.go +11 -1


@@ -914,8 +914,10 @@ func (o *Omnibox) setGhostText(originalInput, suffix, fullText string) {
914	914		func (o *Omnibox) clearGhostText() {
915	915		o.mu.Lock()
916	916		realInput := o.realInput
	917	+	ghostFullText := o.ghostFullText
917	918		hadGhost := o.hasGhostText \|\| o.ghostSuffix != "" \|\| o.ghostFullText != ""
918	919		o.ghostToken++
	920	+	capturedToken := o.ghostToken
919	921		o.ghostSuffix = ""
920	922		o.ghostFullText = ""
921	923		o.hasGhostText = false

@@ -929,10 +931,18 @@ func (o *Omnibox) clearGhostText() {
929	931		if o.entry == nil {
930	932		return false
931	933		}
	934	+	o.mu.RLock()
	935	+	currentToken := o.ghostToken
	936	+	o.mu.RUnlock()
	937	+	if capturedToken != currentToken {
	938	+	return false
	939	+	}
932	940		o.mu.Lock()
933	941		o.isAcceptingGhost = true
934	942		o.mu.Unlock()
935		-	if o.entry.GetText() != realInput {
	943	+	// Only revert text when the entry still shows the previous ghost completion.
	944	+	// If the user typed since scheduling this idle callback, never overwrite it.
	945	+	if o.entry.GetText() == ghostFullText && o.entry.GetText() != realInput {
936	946		o.entry.SetText(realInput)
937	947		}
938	948		o.entry.SelectRegion(-1, -1)

 func (o *Omnibox) clearGhostText() {
 	o.mu.Lock()
 	realInput := o.realInput
+	ghostFullText := o.ghostFullText
 	hadGhost := o.hasGhostText || o.ghostSuffix != "" || o.ghostFullText != ""
 	o.ghostToken++
+	capturedToken := o.ghostToken
 	o.ghostSuffix = ""
 	o.ghostFullText = ""
 	o.hasGhostText = false
 		if o.entry == nil {
 			return false
 		}
+		o.mu.RLock()
+		currentToken := o.ghostToken
+		o.mu.RUnlock()
+		if capturedToken != currentToken {
+			return false
+		}
 		o.mu.Lock()
 		o.isAcceptingGhost = true
 		o.mu.Unlock()
-		if o.entry.GetText() != realInput {
+		// Only revert text when the entry still shows the previous ghost completion.
+		// If the user typed since scheduling this idle callback, never overwrite it.
+		if o.entry.GetText() == ghostFullText && o.entry.GetText() != realInput {
 			o.entry.SetText(realInput)
 		}
 		o.entry.SelectRegion(-1, -1)