K2GO-419 fix(webview): contain render-process death so the app survives

A WebView render process can die for reasons outside the app (system memory
pressure, a Chromium internal abort). If no WebViewClient handles it, the
framework crashes the whole host app. Add one containment line: a base client,
ResilientWebViewClient, whose onRenderProcessGone detaches and destroys the dead
WebView, returns true (so the app is not crashed), and hands the screen a
site-specific recovery.

- Portal: rebuild and reload the same page; an anti-loop window in PortalViewModel
  (it outlives recreate()) sends a page whose renderer keeps dying back to Home
  instead of an endless recreate.
- Help viewer: reload the topic, with the same anti-loop window carried on the
  intent (recreate() preserves it).
- Tooltips (popup and dialog): drop the popup/dialog; the popup one had no client.

The recovery-window value has one source (ResilientWebViewClient.RECOVERY_WINDOW_MS).
Device-verified: forcing real renderer crashes no longer crashes the app.

Author: luisguzman-adfa

controller/app/src/main/java/org/appdevforall/k2go/PortalActivity.java

@@ -13,7 +13,6 @@
 import android.os.Bundle;
 import android.util.Log;
 import android.webkit.WebView;
-import android.webkit.WebViewClient;
 
 import androidx.appcompat.app.AppCompatActivity;
 import androidx.lifecycle.ViewModelProvider;
@@ -37,6 +36,7 @@
 import org.appdevforall.k2go.portal.domain.WebViewVersion;
 import org.appdevforall.k2go.portal.data.PdfViewerCatalog;
 import org.appdevforall.k2go.util.AppExecutors;
+import org.appdevforall.k2go.util.ResilientWebViewClient;
 import java.util.Collections;
 import java.util.List;
 import org.appdevforall.k2go.portal.presentation.GestureWebView;
@@ -216,7 +216,24 @@ protected void onCreate(Bundle savedInstanceState) {
             resetTimer.run();
         });
 
-        webView.setWebViewClient(new WebViewClient() {
+        webView.setWebViewClient(new ResilientWebViewClient() {
+            @Override
+            protected void onRendererGone(boolean crashed) {
+                // K2GO-419: the content WebView (Kiwix/Kolibri/maps/Forgejo) is the highest-exposure
+                // surface. Rebuild the screen and reload the same page. The anti-loop guard lives in
+                // the ViewModel (it outlives recreate()), so a page whose renderer keeps dying does
+                // not spin an endless recreate: after a repeat, inform the user and leave to Home.
+                webView = null;   // the base destroyed it; drop the dangling reference so a pending
+                                  // main-thread callback (onResume cache-clear) bails on its null check.
+                if (vm.allowRendererAutoRecovery()) {
+                    recreate();
+                } else {
+                    Toast.makeText(PortalActivity.this, R.string.k2go_portal_error_body,
+                            Toast.LENGTH_LONG).show();
+                    finish();
+                }
+            }
+
             @Override
             public boolean shouldOverrideUrlLoading(WebView view, android.webkit.WebResourceRequest request) {
                 String url = request.getUrl().toString();

controller/app/src/main/java/org/appdevforall/k2go/help/TooltipManager.java

@@ -31,13 +31,13 @@
 import android.webkit.WebResourceError;
 import android.webkit.WebResourceRequest;
 import android.webkit.WebView;
-import android.webkit.WebViewClient;
 import android.widget.Button;
 import android.widget.LinearLayout;
 import android.widget.PopupWindow;
 import android.widget.TextView;
 
 import org.appdevforall.k2go.ui.dialog.BrandDialog;
+import org.appdevforall.k2go.util.ResilientWebViewClient;
 
 import org.appdevforall.k2go.R;
 
@@ -222,6 +222,12 @@ private static void showPopup(final Context context, final View anchor, final in
 
             View root = LayoutInflater.from(context).inflate(R.layout.tooltip_window, null);
             WebView web = root.findViewById(R.id.help_webview);
+            web.setWebViewClient(new ResilientWebViewClient() {
+                @Override
+                protected void onRendererGone(boolean crashed) {
+                    dismissActive();   // K2GO-419: the tooltip's renderer died; drop the popup, keep the app
+                }
+            });
             TextView seeMore = root.findViewById(R.id.help_see_more);
             LinearLayout linksBox = root.findViewById(R.id.help_links);
 
@@ -321,7 +327,18 @@ public static void dismissActive() {
     public static void openHelpPage(final Context context, String url, String label) {
         try {
             final WebView web = new WebView(context);
-            web.setWebViewClient(new WebViewClient() {
+            final BrandDialog.Handle handle = new BrandDialog(context)
+                    .setTitle(label)
+                    .setContentView(web)
+                    .setPositive(android.R.string.ok, null)
+                    .show();
+            web.setWebViewClient(new ResilientWebViewClient() {
+                @Override
+                protected void onRendererGone(boolean crashed) {
+                    // K2GO-419: the help page's renderer died; drop the dialog, keep the app.
+                    try { handle.dismiss(); } catch (Exception ignored) {}
+                }
+
                 @Override
                 public void onReceivedError(WebView view, WebResourceRequest request,
                                             WebResourceError error) {
@@ -331,11 +348,6 @@ public void onReceivedError(WebView view, WebResourceRequest request,
                                     + "</body></html>", "text/html", "utf-8");
                 }
             });
-            new BrandDialog(context)
-                    .setTitle(label)
-                    .setContentView(web)
-                    .setPositive(android.R.string.ok, null)
-                    .show();
             web.loadUrl(url);
         } catch (Exception e) {
             Log.e(TAG, "openHelpPage failed: " + e.getMessage());

controller/app/src/main/java/org/appdevforall/k2go/portal/presentation/PortalViewModel.java

@@ -8,18 +8,26 @@
  */
 package org.appdevforall.k2go.portal.presentation;
 
+import android.os.SystemClock;
+
 import androidx.lifecycle.LiveData;
 import androidx.lifecycle.MutableLiveData;
 import androidx.lifecycle.ViewModel;
 
 import org.appdevforall.k2go.portal.domain.PortalUrlResolver;
+import org.appdevforall.k2go.util.ResilientWebViewClient;
 
 /** Survives rotation: keeps the resolved target URL and the page-load state. */
 public class PortalViewModel extends ViewModel {
 
     private final MutableLiveData<PortalUiState> state = new MutableLiveData<>(PortalUiState.idle());
     private String targetUrl;
 
+    // K2GO-419: renderer-crash recovery bookkeeping. The ViewModel outlives Activity.recreate(), so
+    // this is the one place that remembers "we just recovered" across the rebuild, so a page whose
+    // renderer keeps dying is not reloaded in an endless recreate loop. Window source: ResilientWebViewClient.
+    private long lastRendererRecoveryMs = 0L;
+
     public LiveData<PortalUiState> state() { return state; }
 
     public boolean isLoading() {
@@ -38,4 +46,19 @@ public String targetUrl(String rawUrl) {
         }
         return targetUrl;
     }
+
+    /**
+     * K2GO-419: true when the portal may auto-recover (rebuild + reload) after a renderer death.
+     * False when a second death lands within {@link ResilientWebViewClient#RECOVERY_WINDOW_MS}, so the caller
+     * breaks the loop (inform the user and leave) instead of reloading a page that keeps killing the
+     * renderer. Records this attempt's time. Uses the monotonic clock so a wall-clock change cannot
+     * skew the window.
+     */
+    public boolean allowRendererAutoRecovery() {
+        long now = SystemClock.elapsedRealtime();
+        boolean recentlyRecovered = lastRendererRecoveryMs != 0L
+                && (now - lastRendererRecoveryMs) < ResilientWebViewClient.RECOVERY_WINDOW_MS;
+        lastRendererRecoveryMs = now;
+        return !recentlyRecovered;
+    }
 }

controller/app/src/main/java/org/appdevforall/k2go/redesign/HelpViewerActivity.java

@@ -21,7 +21,6 @@
 import android.webkit.WebResourceRequest;
 import android.webkit.WebResourceResponse;
 import android.webkit.WebView;
-import android.webkit.WebViewClient;
 import android.widget.Toast;
 
 import androidx.annotation.Nullable;
@@ -43,6 +42,7 @@
 import org.appdevforall.k2go.portal.domain.PdfViewerUrl;
 import org.appdevforall.k2go.portal.domain.WebViewVersion;
 import org.appdevforall.k2go.util.AppExecutors;
+import org.appdevforall.k2go.util.ResilientWebViewClient;
 
 import java.util.Collections;
 import java.util.List;
@@ -98,7 +98,24 @@ protected void onCreate(@Nullable Bundle savedInstanceState) {
         // dual-build routing as PortalActivity). Offline-safe: returns empty when no box is up.
         AppExecutors.get().io().execute(() -> pdfViewerBuilds = PdfViewerCatalog.fetch());
 
-        webView.setWebViewClient(new WebViewClient() {
+        webView.setWebViewClient(new ResilientWebViewClient() {
+            @Override
+            protected void onRendererGone(boolean crashed) {
+                // K2GO-419: reload the same topic (from the intent + bundled assets) on a renderer
+                // death, but do not loop: if a second death lands within the recovery window, close
+                // the viewer instead of reloading a topic that keeps killing the renderer. The window
+                // marker rides the intent, which recreate() preserves. Same window as PortalActivity.
+                final String extraLastRecovery = "k2go_help_last_recovery";
+                long now = android.os.SystemClock.elapsedRealtime();
+                long last = getIntent() != null ? getIntent().getLongExtra(extraLastRecovery, 0L) : 0L;
+                if (last != 0L && now - last < ResilientWebViewClient.RECOVERY_WINDOW_MS) {
+                    finish();
+                    return;
+                }
+                if (getIntent() != null) getIntent().putExtra(extraLastRecovery, now);
+                recreate();
+            }
+
             @Override
             public WebResourceResponse shouldInterceptRequest(WebView view, WebResourceRequest request) {
                 return assetLoader.shouldInterceptRequest(request.getUrl());

controller/app/src/main/java/org/appdevforall/k2go/util/ResilientWebViewClient.java

@@ -0,0 +1,73 @@
+/*
+ * ============================================================================
+ * Name        : ResilientWebViewClient.java
+ * Author      : AppDevForAll
+ * Copyright   : Copyright (c) 2026 AppDevForAll
+ * Description : K2GO-419. One containment line for WebView render-process death.
+ * ============================================================================
+ */
+package org.appdevforall.k2go.util;
+
+import android.os.Build;
+import android.util.Log;
+import android.view.ViewGroup;
+import android.view.ViewParent;
+import android.webkit.RenderProcessGoneDetail;
+import android.webkit.WebView;
+import android.webkit.WebViewClient;
+
+import androidx.annotation.RequiresApi;
+
+/**
+ * Base WebViewClient that keeps the app alive when a WebView render process dies.
+ *
+ * <p>A render process can die for reasons outside the app: system memory pressure, or a Chromium
+ * internal abort (K2GO-419 saw the renderer crash inside libwebviewchromium.so, no app frames). If
+ * no WebViewClient handles that death, the framework crashes the whole host app. See
+ * https://developer.android.com/reference/android/webkit/WebViewClient#onRenderProcessGone(android.webkit.WebView,%20android.webkit.RenderProcessGoneDetail)
+ *
+ * <p>This client handles it in one place: it detaches and destroys the dead WebView (the object is
+ * unusable after a renderer death) and returns true, so the app survives, then hands the screen its
+ * own recovery through {@link #onRendererGone(boolean)}. Subclass this instead of WebViewClient.
+ *
+ * <p>onRenderProcessGone exists since API 26. On API 24-25 the framework never calls it and the app
+ * still dies there, which cannot be helped from the app side.
+ */
+public abstract class ResilientWebViewClient extends WebViewClient {
+
+    private static final String TAG = "ResilientWebView";
+
+    /**
+     * Shared anti-loop window. When a second renderer death lands within this of a recovery, the
+     * recovering screen must stop reloading and bail (leave/close), so a page that reliably kills the
+     * renderer cannot spin an endless reload. One source for the value, used by every recovery path.
+     */
+    public static final long RECOVERY_WINDOW_MS = 15_000L;
+
+    @RequiresApi(api = Build.VERSION_CODES.O)
+    @Override
+    public final boolean onRenderProcessGone(WebView view, RenderProcessGoneDetail detail) {
+        // didCrash()==false means the system reclaimed the renderer under memory pressure, not a bug.
+        boolean crashed = detail != null && detail.didCrash();
+        Log.w(TAG, "WebView renderer gone (didCrash=" + crashed + "); containing to keep the app alive");
+        ViewParent parent = view.getParent();
+        if (parent instanceof ViewGroup) {
+            ((ViewGroup) parent).removeView(view);
+        }
+        view.destroy();
+        try {
+            onRendererGone(crashed);
+        } catch (Throwable t) {
+            Log.e(TAG, "renderer recovery failed", t);
+        }
+        return true;   // handled: the framework must NOT crash the host app
+    }
+
+    /**
+     * Recover the screen after the dead WebView has been detached and destroyed. Typical actions:
+     * rebuild the screen and reload the same page, or dismiss a transient popup or dialog. The
+     * crashed flag is false when the system evicted the renderer under memory pressure rather than a
+     * real crash. Called on the main thread.
+     */
+    protected abstract void onRendererGone(boolean crashed);
+}