Bump bundled JCEF/CEF to 146.0.10 to fix macOS BrowserComponent crash (supersedes Fontations flag workaround)

Ports/JavaSE/src/com/codename1/impl/javase/cef/CEFBrowserComponent.java

@@ -25,6 +25,7 @@
 import com.codename1.impl.javase.IBrowserComponent;
 import com.codename1.impl.javase.JavaSEPort;
 import com.codename1.impl.javase.JavaSEPort.Peer;
+import com.codename1.io.Log;
 import com.codename1.ui.BrowserComponent;
 import com.codename1.ui.CN;
 import com.codename1.ui.Display;
@@ -115,21 +116,55 @@ protected void deinitialize() {
 
 
 
+    /**
+     * System property that overrides the value passed to Chromium's
+     * {@code --disable-features} switch. When set to a non-empty value, that value is
+     * used verbatim; setting it to the empty string clears the default so no
+     * {@code --disable-features} switch is passed. When the property is unset the
+     * platform default from {@link #defaultDisableFeatures()} is applied.
+     */
+    static final String DISABLE_FEATURES_PROPERTY = "cef.disableFeatures";
+
+    /**
+     * Default set of Chromium features to disable via {@code --disable-features}.
+     *
+     * <p>Chromium 135 (CEF 135 / JCEF 135.0.20) shipped the Skia "Fontations" Rust font
+     * backend, which panicked in its color-table code path
+     * ({@code has_any_color_table} -> {@code crash_in_rust_with_overflow}) while laying
+     * out fonts on recent macOS, killing the simulator JVM with SIGTRAP (exit 133) as
+     * soon as a BrowserComponent painted. The underlying crash is fixed upstream in the
+     * newer Chromium bundled by CEF/JCEF (see {@code jcefmaven.version} in maven/pom.xml,
+     * now CEF 146 / Chromium 146), so this switch is no longer required. It is retained
+     * only as a low-risk safety net for the bundled font stack; disabling
+     * {@code FontationsFontBackend} (chrome://flags/#enable-fontations-backend) forces
+     * Chromium back to the FreeType backend. Only the JavaSE simulator's bundled CEF is
+     * affected; the iOS (WKWebView) and Android (system WebView) ports are untouched.</p>
+     *
+     * <p>Gated to macOS so Windows/Linux behavior is unchanged. Passed as a jcef arg
+     * (see {@code CN1JcefRuntime.createBuilder}); Chromium propagates {@code --disable-features}
+     * to the CEF helper subprocesses automatically via its FeatureList mechanism. The
+     * {@code -Dcef.disableFeatures=...} system property overrides this on any platform
+     * (an empty value disables it entirely).</p>
+     */
+    private static String defaultDisableFeatures() {
+        return isMac ? "FontationsFontBackend" : null;
+    }
+
     private static String[] createArgs() {
         List<String> args = new ArrayList<String>();
         if (isMac) {
             args.add("--disable-gpu");
         } else if (isWindows) {
             // no extra stuff here
             //args.add(String.format("--browser-subprocess-path=%s\\jcef_helper.exer", getLibPath()));
-            
+
             args.add("--disable-gpu");
             args.add("--disable-software-rasterizer");
             args.add("--disable-gpu-compositing");
         } else if (isUnix) {
             // no extra stuff here
             //args.add(String.format("--browser-subprocess-path=%s\\jcef_helper.exer", getLibPath()));
-            
+
             args.add("--disable-gpu");
             args.add("--disable-software-rasterizer");
             args.add("--disable-gpu-compositing");
@@ -143,7 +178,14 @@ private static String[] createArgs() {
         //args.add("--force-device-scale-factor=4");
         args.add("--autoplay-policy=no-user-gesture-required");
         args.add("--enable-usermedia-screen-capturing");
-        //System.out.println("CEF Args: "+args);
+
+        String prop = System.getProperty(DISABLE_FEATURES_PROPERTY);
+        String disableFeatures = prop != null ? prop : defaultDisableFeatures();
+        if (disableFeatures != null && disableFeatures.length() > 0) {
+            args.add("--disable-features=" + disableFeatures);
+        }
+
+        Log.p("CEF Args: " + args, Log.DEBUG);
         return args.toArray(new String[args.size()]);
     }
 

maven/javase/pom.xml

@@ -143,13 +143,19 @@
                 </exclusion>
             </exclusions>
         </dependency>
-        <!-- commons-compress 1.27.1, used by JCEF Maven to extract native
-             bundles, requires BoundedInputStream.builder() from Commons IO
-             2.16.1. The reactor otherwise manages Commons IO at 2.14.0. -->
+        <!-- commons-compress 1.28.0, which JCEF Maven 146 uses to extract the
+             native bundles, calls AbstractStreamBuilder.getInputStream() and
+             requires Commons IO 2.20.0 (its own declared dependency). An older
+             Commons IO on the classpath throws IllegalAccessError from
+             GzipCompressorInputStream during native extraction. The root
+             reactor's dependencyManagement pins commons-io to this same version;
+             this direct pin keeps standalone consumers of codenameone-javase (who
+             don't inherit the reactor's dependencyManagement) on 2.20.0 too. Keep
+             both in sync with commons-compress when bumping jcefmaven.version. -->
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
-            <version>2.16.1</version>
+            <version>2.20.0</version>
         </dependency>
         <dependency>
             <groupId>com.codenameone</groupId>

maven/pom.xml

@@ -69,8 +69,8 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <java.version>1.8</java.version>
         <java-tests.version>11</java-tests.version>
-        <jcefmaven.version>135.0.20</jcefmaven.version>
-        <jcef.version>jcef-ca49ada+cef-135.0.20+ge7de5c3+chromium-135.0.7049.85</jcef.version>
+        <jcefmaven.version>146.0.10</jcefmaven.version>
+        <jcef.version>jcef-d3de827+cef-146.0.10+g8219561+chromium-146.0.7680.179</jcef.version>
         <ffmpeg.version>7.1-1.5.11</ffmpeg.version>
         <rhino.version>1.7.11</rhino.version>
         <maven-compiler-plugin.version>3.8.0</maven-compiler-plugin.version>
@@ -357,11 +357,17 @@
                 <artifactId>maven-invoker-plugin</artifactId>
                 <version>3.2.1</version>
             </dependency>
-            <!-- https://mvnrepository.com/artifact/commons-io/commons-io -->
+            <!-- https://mvnrepository.com/artifact/commons-io/commons-io
+                 Managed to 2.20.0 because JCEF Maven 146's commons-compress
+                 1.28.0 requires it to extract the native bundle; a reactor
+                 module (e.g. the javase-cef-ffmpeg-smoke app) that pulls
+                 codenameone-javase would otherwise have commons-io forced back
+                 to an older managed version and throw IllegalAccessError. Keep
+                 in sync with the commons-io pin in maven/javase/pom.xml. -->
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
-                <version>2.16.1</version>
+                <version>2.20.0</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>

scripts/ci-install-upstream-jcef-jar.sh

@@ -51,8 +51,13 @@ install_artifact() {
 
 install_artifact me/friwi jcef-api "$jcef_ver" jcef.jar
 install_artifact me/friwi jcefmaven "$jcefmaven_ver" jcefmaven.jar
-install_artifact org/apache/commons commons-compress 1.27.1 commons-compress.jar
+# These helper jars mirror JCEF Maven's transitive dependencies for the Ant
+# build. Keep them aligned with the versions jcefmaven.version actually resolves
+# (JCEF Maven 146 -> commons-compress 1.28.0, which in turn requires commons-io
+# 2.20.0; a stale commons-io throws IllegalAccessError while extracting the
+# native bundle). commons-codec/commons-lang3 track commons-compress 1.28.0.
+install_artifact org/apache/commons commons-compress 1.28.0 commons-compress.jar
 install_artifact com/google/code/gson gson 2.11.0 gson.jar
-install_artifact commons-codec commons-codec 1.17.1 commons-codec.jar
-install_artifact commons-io commons-io 2.16.1 commons-io.jar
-install_artifact org/apache/commons commons-lang3 3.16.0 commons-lang3.jar
+install_artifact commons-codec commons-codec 1.19.0 commons-codec.jar
+install_artifact commons-io commons-io 2.20.0 commons-io.jar
+install_artifact org/apache/commons commons-lang3 3.18.0 commons-lang3.jar