From 5325a51b64270fc2fcaac287832043a011afa4ed Mon Sep 17 00:00:00 2001
From: lkn <lkn@localhost>
Date: Sun, 21 Jun 2026 17:43:42 +0200
Subject: [PATCH] wayland: fix double-free crash when destroying shared
 WApplication
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When main_window_desc is the real WWindow (found via wWindowFor rather
than created by makeMainWindow), wApplicationDestroy must not call
wWindowDestroy on it — the window is still managed and will be destroyed
by wUnmanageWindow. Add shared_main_desc flag to track ownership.
---
 src/application.c | 19 +++++++++++--------
 src/application.h |  1 +
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/src/application.c b/src/application.c
index 113f578..8d2bd8a 100644
--- a/src/application.c
+++ b/src/application.c
@@ -117,7 +117,9 @@ WApplication *wApplicationCreate(WWindow * wwin)
 	/* If the main_window is also the client window (Wayland native apps),
 	 * reuse the existing WWindow which already has a frame. */
 	wapp->main_window_desc = wWindowFor(main_window);
-	if (!wapp->main_window_desc) {
+	if (wapp->main_window_desc) {
+		wapp->flags.shared_main_desc = 1;
+	} else {
 		wapp->main_window_desc = makeMainWindow(scr, main_window);
 		if (!wapp->main_window_desc) {
 			wfree(wapp);
@@ -194,13 +196,14 @@ void wApplicationDestroy(WApplication *wapp)
 	/* Remove application icon */
 	removeAppIconFor(wapp);
 
-	wwin = wWindowFor(wapp->main_window_desc->client_win);
-
-	wWindowDestroy(wapp->main_window_desc);
-	if (wwin) {
-		/* undelete client window context that was deleted in
-		 * wWindowDestroy */
-		wm_backend->context_save(wwin->client_win, WM_CTX_CLIENT_WIN, &wwin->client_descriptor);
+	if (!wapp->flags.shared_main_desc) {
+		wwin = wWindowFor(wapp->main_window_desc->client_win);
+		wWindowDestroy(wapp->main_window_desc);
+		if (wwin) {
+			/* undelete client window context that was deleted in
+			 * wWindowDestroy */
+			wm_backend->context_save(wwin->client_win, WM_CTX_CLIENT_WIN, &wwin->client_descriptor);
+		}
 	}
 	wfree(wapp);
 }
diff --git a/src/application.h b/src/application.h
index a2a6bf3..c56e057 100644
--- a/src/application.h
+++ b/src/application.h
@@ -41,6 +41,7 @@ typedef struct WApplication {
         unsigned int hidden:1;
         unsigned int emulated:1;
         unsigned int bouncing:1;
+        unsigned int shared_main_desc:1;
     } flags;
 } WApplication;