fix(macos): order windows out on exit to prevent KVO crash

On macOS, winit's event handler teardown triggers a display cycle flush
that finds _NSTouchBarFinderObservation KVO observers on objects in an
inconsistent state, causing a SIGILL crash via _crashOnException:.

Fix: call [window orderOut:nil] on all windows as the first action in
on_exit(), before returning control to eframe/winit. This lets AppKit
properly tear down its display-related observations while the windows
and their views are still alive.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lklimek

src/app.rs

@@ -1646,6 +1646,11 @@ impl App for AppState {
     }
 
     fn on_exit(&mut self, _gl: Option<&eframe::glow::Context>) {
+        // On macOS, order windows out before winit tears down the event
+        // handler. This lets AppKit properly clean up display-related KVO
+        // observers (TouchBar, etc.) while views are still alive.
+        crate::platform::order_out_all_windows();
+
         // If shutdown_receiver is Some, the async shutdown was already initiated
         // in update(). Skip the blocking fallback to avoid double-shutdown.
         // The blocking path only runs when the window was force-closed without

src/platform/macos.rs

@@ -2,6 +2,43 @@ use objc2::MainThreadMarker;
 use objc2::msg_send;
 use objc2::runtime::{AnyClass, AnyObject};
 
+/// Orders all application windows out (hides them) so that AppKit can
+/// properly tear down display-related observations — in particular
+/// `_NSTouchBarFinderObservation` KVO observers — while the windows and
+/// their views are still alive.
+///
+/// Without this, winit's event handler teardown triggers a display cycle
+/// flush that finds KVO observers on inconsistent objects, causing a
+/// SIGILL crash via `_crashOnException:`.
+///
+/// Must be called from `on_exit()` before returning control to the
+/// eframe/winit shutdown path.
+pub fn order_out_all_windows(_mtm: MainThreadMarker) {
+    unsafe {
+        let Some(cls) = AnyClass::get(c"NSApplication") else {
+            return;
+        };
+        let app: *mut AnyObject = msg_send![cls, sharedApplication];
+        if app.is_null() {
+            return;
+        }
+
+        let windows: *mut AnyObject = msg_send![app, windows];
+        if windows.is_null() {
+            return;
+        }
+
+        let count: usize = msg_send![windows, count];
+        for i in 0..count {
+            let window: *mut AnyObject = msg_send![windows, objectAtIndex: i];
+            if !window.is_null() {
+                let _: () = msg_send![window, orderOut: std::ptr::null::<AnyObject>()];
+            }
+        }
+        tracing::debug!("Ordered out {count} windows for clean shutdown");
+    }
+}
+
 /// Queries `accessibilityChildren` on the key window's content view to force
 /// macOS to call the AccessKit adapter's subclassed method, which transitions
 /// the adapter from `Inactive` to `Active`. Without this, tools like Peekaboo

src/platform/mod.rs

@@ -29,3 +29,16 @@ pub fn force_accessibility_activation() -> bool {
         true
     }
 }
+
+/// Orders all windows out before shutdown so macOS can clean up
+/// display-related observations. No-op on non-macOS platforms.
+pub fn order_out_all_windows() {
+    #[cfg(target_os = "macos")]
+    {
+        let Some(mtm) = objc2::MainThreadMarker::new() else {
+            tracing::error!("order_out_all_windows called from non-main thread");
+            return;
+        };
+        macos::order_out_all_windows(mtm);
+    }
+}