When changing a surface from managed to unmanaged in handle_map(), the call to handle_destroy(.., view) causes the sway_xwayland_view pointed to by the untyped wlr_xwayland_surface.data field to become invalid garbage, yet the untyped wlr_xwayland_surface.data continues to point at it. In particular: view_get_*(view_from_wlr_surface(..)), even with appropriate NULL checking, will crash sway when this codepath is exercised (reliable test case: drop-down menus in Google Earth). |
||
|---|---|---|
| .. | ||
| desktop.c | ||
| idle_inhibit_v1.c | ||
| layer_shell.c | ||
| output.c | ||
| render.c | ||
| transaction.c | ||
| xdg_shell.c | ||
| xwayland.c | ||