From 711ff08b577e5e7dc9a19ac2efc79d6d2b64bce2 Mon Sep 17 00:00:00 2001 From: lkn Date: Tue, 23 Jun 2026 21:24:52 +0200 Subject: [PATCH] revert unsafe titlebar resize: draw into parent frame instead The in-place resize of titlebar pixman images continues to cause heap corruption regardless of scene buffer detach order. Fall back to drawing into the parent frame buffer when the titlebar is too narrow, which is always safe since fb->image is already the correct size. --- src/backend/wayland/wl_framebuf.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) diff --git a/src/backend/wayland/wl_framebuf.c b/src/backend/wayland/wl_framebuf.c index 2bfea5e..3a194ad 100644 --- a/src/backend/wayland/wl_framebuf.c +++ b/src/backend/wayland/wl_framebuf.c @@ -578,22 +578,11 @@ wl_frame_paint(struct WFrameWindow *fwin) wlr_scene_node_set_position(&tb_fb->scene_buf->node, 0, 0); } - /* Resize titlebar buffer if too narrow — detach from scene graph - * first so the old pixel data isn't accessed after being freed. */ + /* If titlebar buffer is too narrow, draw directly into the + * parent frame buffer to avoid unsafe in-place resize. */ if (tb_fb && tb_fb->width < tb_w) { - if (tb_fb->scene_buf) - wlr_scene_buffer_set_buffer(tb_fb->scene_buf, NULL); - pixman_image_unref(tb_fb->image); - tb_fb->image = pixman_image_create_bits(PIXMAN_a8r8g8b8, - tb_w, tb_h, NULL, 0); - tb_fb->width = tb_w; - tb_fb->height = tb_h; - tb_fb->base.width = tb_w; - tb_fb->base.height = tb_h; - tb_img = tb_fb->image; - W_RegisterBacking(tb_fb->id, tb_fb->image); - if (tb_fb->scene_buf) - wlr_scene_buffer_set_dest_size(tb_fb->scene_buf, tb_w, tb_h); + tb_img = fb->image; + tb_fb = NULL; } WTexture *tex = fwin->title_texture[state];