From bf356c25677495a378aeba37bd265222b0026f84 Mon Sep 17 00:00:00 2001 From: Window Maker Date: Sun, 24 May 2026 19:05:35 +0200 Subject: [PATCH] WINGs/wclient_wl: clear input focus refs on toplevel destroy When a popup toplevel is destroyed (e.g., menu editor submenu closes), its WLClientToplevel struct is freed. If wlc_kbd_focused or wlc_ptr_focused pointed to it, subsequent input events dereferenced the dangling pointer and crashed (saw it in keyboard_handle_leave). Clear both refs in wl_client_view_destroy_backing before freeing. --- WINGs/wclient_wl.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/WINGs/wclient_wl.c b/WINGs/wclient_wl.c index dc69713..565a63c 100644 --- a/WINGs/wclient_wl.c +++ b/WINGs/wclient_wl.c @@ -417,8 +417,15 @@ wl_client_view_commit(unsigned long id) static void wl_client_view_destroy_backing(unsigned long id) { + extern WLClientToplevel *wlc_kbd_focused; + extern WLClientToplevel *wlc_ptr_focused; WLClientToplevel *top = wlc_top_find((WNativeWindow)id); if (!top) return; + /* Clear any input-focus references that point to this toplevel + * before we free it, so subsequent input events don't dereference + * a dangling pointer. */ + if (wlc_kbd_focused == top) wlc_kbd_focused = NULL; + if (wlc_ptr_focused == top) wlc_ptr_focused = NULL; if (top->wmaker_popup) wmaker_popup_v1_destroy(top->wmaker_popup); if (top->xdg_toplevel) xdg_toplevel_destroy(top->xdg_toplevel); if (top->xdg_surface) xdg_surface_destroy(top->xdg_surface); @@ -608,7 +615,7 @@ wlc_xkb_mod_mask(struct xkb_state *state) static double wlc_ptr_x, wlc_ptr_y; static uint32_t wlc_ptr_focus_serial; uint32_t wlc_ptr_button_serial; /* serial of most recent button press */ -static WLClientToplevel *wlc_ptr_focused; +WLClientToplevel *wlc_ptr_focused; unsigned int wlc_ptr_button_state; static unsigned int wlc_ptr_mods; static W_View *wlc_ptr_child_focus; @@ -871,7 +878,7 @@ static const struct wl_pointer_listener pointer_listener = { /* Keyboard */ /* ------------------------------------------------------------------ */ -static WLClientToplevel *wlc_kbd_focused; +WLClientToplevel *wlc_kbd_focused; static void keyboard_handle_keymap(void *data, struct wl_keyboard *k,