Bypass broken fade-out path to eliminate double-free recursion - #49
Open
jEsuSdA wants to merge 1 commit into
Open
Bypass broken fade-out path to eliminate double-free recursion#49jEsuSdA wants to merge 1 commit into
jEsuSdA wants to merge 1 commit into
Conversation
The fade-out path in destroy_win() is broken: 1. destroy_win() calls set_fade() with destroy_callback as the callback 2. When the fade completes, dequeue_fade() calls destroy_callback() 3. destroy_callback() calls finish_destroy_win() 4. finish_destroy_win() calls cleanup_fade() 5. cleanup_fade() calls dequeue_fade() again 6. dequeue_fade() calls destroy_callback() again on the same win* 7. finish_destroy_win() runs a second time on the freed/already-destroyed win*, causing a double-free / use-after-free Since fading is already known to be broken and not maintained, the safest fix is to bypass the fade-out path entirely. destroy_win() now always calls finish_destroy_win() directly, and the unused destroy_callback is removed. This eliminates the recursive double-free while keeping the code simpler. Note: fade-in (set_fade on map) is unaffected and continues to work if enabled.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bypasses the broken fade-out path in
destroy_win()to eliminate a recursive double-free crash.Problem
The fade-out path is broken:
destroy_win()callsset_fade()withdestroy_callbackas the callbackdequeue_fade()callsdestroy_callback()destroy_callback()callsfinish_destroy_win()finish_destroy_win()callscleanup_fade()cleanup_fade()callsdequeue_fade()againdequeue_fade()callsdestroy_callback()again on the samewin*finish_destroy_win()runs a second time on the freed/already-destroyedwin*, causing a double-free / use-after-freeSolution
Since fading is already known to be broken and not maintained, the safest fix is to bypass the fade-out path entirely.
destroy_win()now always callsfinish_destroy_win()directly, and the unuseddestroy_callbackis removed.This eliminates the recursive double-free while keeping the code simpler. Note: fade-in (set_fade on map) is unaffected and continues to work if enabled.
Scope
fastcompmgr.cis touchedmake clean && makeproduces zero warnings, zero errorsImpact
Eliminates a crash path during window destruction. No functional change for users who do not use fading (the default).