fix(android): async webview constrcution

[friofry]

• fixes deadlock [browser] freezes when I click on a bookmark on an empty tab status-app#20886

[Copilot]

Pull request overview

This PR addresses an Android deadlock during WebView construction by making WebView initialization non-blocking and queueing UI-thread actions until the WebView is ready. It also improves early bridge/script injection behavior and adds test/CI coverage for the new pending-action mechanism.

Changes:

• Make Android WebView creation asynchronous (remove blocking wait) and introduce a PendingActionQueue to replay queued UI actions once initialization completes.
• Add document-start script injection support (via reflective androidx.webkit APIs) and update bridge/bootstrap readiness signaling in JS.
• Add a small Java test for the pending-action queue and wire it into CI; remove a JNI “getWebView” validation call that could contribute to deadlock.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
mobilewebview/src/js/bootstrap_page.js	Exposes a synchronous window[ns].__ready flag before emitting qtWebChannelReady.
mobilewebview/src/android/mobilewebviewbackend_android.cpp	Removes eager getWebView() call during Java object setup.
mobilewebview/android/src/org/mobilewebview/PendingActionQueue.java	Adds a queue to defer actions until WebView initialization completes.
mobilewebview/android/src/org/mobilewebview/MobileWebView.java	Switches to async initialization, queues main-thread work, and adds document-start injection via reflection.
mobilewebview/android/tests/org/mobilewebview/MobileWebViewPendingActionsTest.java	Adds a basic ordering/behavior test for PendingActionQueue.
.github/workflows/ci.yml	Compiles/runs the new Java utility test in CI.

Comments suppressed due to low confidence (1)

mobilewebview/android/src/org/mobilewebview/MobileWebView.java:888

• buildAllowedOriginRules() falls back to adding "" when the allowed-origins list is empty. This changes the effective meaning of an empty allowlist from "deny all" (OriginUtils.isOriginAllowed returns false for empty lists) to "inject into all origins" for document-start injection, which can unintentionally expose the bridge/user scripts on untrusted origins (including subframes) when allowedOrigins is temporarily unset/empty. Consider only including "" when it is explicitly configured by the caller (or return an empty set and make registerDocumentStartScripts()/configureBridgeInjectionMode disable document-start injection when there are no allowed origins).

    private static Set<String> buildAllowedOriginRules(List<String> allowedOrigins) {
        Set<String> allowedOriginRules = new HashSet<>();
        for (String origin : allowedOrigins) {
            if (origin != null && !origin.isEmpty()) {
                allowedOriginRules.add(origin);
            }
        }

        if (allowedOriginRules.isEmpty()) {
            allowedOriginRules.add("*");
        }
        return allowedOriginRules;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.