Skip to content

window-list: disconnect scale_factor signal on destroy (fixes SIGSEGV on window close)#472

Merged
trigg merged 1 commit into
WayfireWM:masterfrom
borisi1:fix-window-list-scale-uaf
Jun 4, 2026
Merged

window-list: disconnect scale_factor signal on destroy (fixes SIGSEGV on window close)#472
trigg merged 1 commit into
WayfireWM:masterfrom
borisi1:fix-window-list-scale-uaf

Conversation

@borisi1
Copy link
Copy Markdown
Contributor

@borisi1 borisi1 commented Jun 4, 2026

Since 25d9879 (window-list icon-size), wf-panel crashes with SIGSEGV when a window closes — e.g. restarting an application.

The scale_factor signal connection added in that commit is the only connection in WayfireToplevel::impl that is not stored in the signals vector. Every other connection is stored and disconnected in the destructor:

for (auto signal : signals)
    signal.disconnect();

Because this one is untracked, it is never disconnected. When the toplevel is destroyed, the button's scale_factor property still changes during teardown and fires on_scale_update() on the freed object → set_app_id()IconProvider::image_set_icon() on a destroyed Gtk::Image, crashing inside the GTK4 CSS/style chain.

Fix: store the connection in signals like all the others so it is cleaned up with them.

Reproduce: launch a GUI application, then close/restart it — wf-panel crashes. With this patch the panel survives repeated open/close cycles.

…d on destroy

The scale_factor signal connection added in 25d9879 is the only connection
in WayfireToplevel::impl that is not stored in the \`signals\` vector, so it is
never disconnected. When a toplevel is destroyed (e.g. closing or restarting
an application) the button's scale_factor still changes during teardown and
fires on_scale_update() on the freed object, crashing wf-panel with SIGSEGV
inside the GTK4 style chain (set_app_id -> image_set_icon on a destroyed
Gtk::Image).

Store the connection in \`signals\` like every other connection so the
destructor disconnects it.
@trigg
Copy link
Copy Markdown
Collaborator

trigg commented Jun 4, 2026

It seems odd to me that this doesn't cause a crash on any of my machines.

That aside, this fix is still the correct thing to do, even if I can't reproduce the crash.

Thank you for the PR!

@trigg trigg merged commit ac85973 into WayfireWM:master Jun 4, 2026
2 checks passed
@borisi1
Copy link
Copy Markdown
Contributor Author

borisi1 commented Jun 4, 2026

I found it with manual restart of an app but the following script should catch it as well:

pid=$(pgrep -x wf-panel)
if [ -z "$pid" ]; then
echo "wf-panel is not running — start the panel first."
exit 1
fi
echo "panel PID: $pid"

app=${1:-konsole} # pass another GUI app as $1 if you prefer, e.g. ./script.sh alacritty

for i in $(seq 30); do
"$app" &
k=$!
sleep 0.4
kill "$k" 2>/dev/null
sleep 0.3
if ! kill -0 "$pid" 2>/dev/null; then
echo "❌ PANEL DIED on iteration $i"
exit 1
fi
done

@borisi1 borisi1 deleted the fix-window-list-scale-uaf branch June 4, 2026 23:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants