fix(apple): present windowed macOS PyroWave via IOSurface layer contents — swapID panic survives glass pacing
ci / bench (push) Successful in 7m3s
deb / build-publish (push) Successful in 9m22s
decky / build-publish (push) Successful in 21s
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Successful in 11s
arch / build-publish (push) Successful in 12m22s
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Successful in 10s
android / android (push) Successful in 13m43s
docker / build-push (ci, ci/rust-ci-noble.Dockerfile, punktfunk-rust-ci-noble) (push) Successful in 9s
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Successful in 9s
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Successful in 9s
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Successful in 9s
deb / build-publish-host (push) Successful in 12m40s
rpm / build-publish (44, fedora-44, punktfunk-fedora44-rpm) (push) Successful in 15m34s
rpm / build-publish (43, bazzite, punktfunk-fedora-rpm) (push) Successful in 15m41s
ci / rust (push) Successful in 28m55s
apple / swift (push) Successful in 1m20s
release / apple (push) Successful in 9m32s
ci / web (push) Successful in 46s
ci / docs-site (push) Successful in 1m5s
apple / screenshots (push) Successful in 6m28s
docker / deploy-docs (push) Successful in 26s

The DCP "mismatched swapID's" kernel panic reproduced on a 240 Hz Mac
Studio with stage-3 glass pacing active: a fully serialized,
one-in-flight present stream still races WindowServer's own swap
submissions. So the mitigation has to change the MECHANISM, not the
rate — the CAMetalLayer image queue itself is the racing path in a
composited (windowed) session.

Windowed PyroWave now presents the way video players do: the planar
CSC renders into a pooled IOSurface (4 × BGRA8, in-use-aware LRU
reuse) and the render thread hands it to a plain CALayer's `contents`
on main inside an ordinary CATransaction. WindowServer treats that as
normal layer damage on its own composite cadence — no out-of-band
image-queue swaps to race. Fullscreen keeps the CAMetalLayer path
(direct scanout, no compositing, no panic reports); the hosting view
pushes the window's composited state on every layout, and flipping
modes just covers/uncovers the metal layer (no black flash).

VT codecs keep the metal path everywhere: no panic reports there, and
their HDR/EDR presentation has no surface-contents equivalent wired.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
2026-07-18 11:51:31 +02:00
parent 574e3e4e3f
commit f407f41855
4 changed files with 259 additions and 0 deletions
@@ -692,6 +692,11 @@ public final class StreamLayerView: NSView {
/// the view's physical-pixel size (bounds backing), so a window resize / retina move follows.
private func layoutPresenter() {
presenter.layout(in: bounds, contentsScale: window?.backingScaleFactor ?? 1)
// Present routing tracks the window's composited state (fullscreen transitions always
// re-layout, so this stays current): windowed PyroWave presents via surface contents
// the DCP swapID kernel-panic mitigation (see SessionPresenter.setComposited). A view
// not yet in a window counts as composited (the safe default).
presenter.setComposited(!(window?.styleMask.contains(.fullScreen) ?? false))
// Feed the follower only once in a window (backing scale is real then) and with real
// bounds a pre-window layout would report point-sized dimensions.
if window != nil, bounds.width > 0, bounds.height > 0 {