From 20322484b937a862bbf0c3a0d1900930e6c48a8c Mon Sep 17 00:00:00 2001 From: outfoxxed Date: Sun, 15 Jun 2025 02:26:21 -0700 Subject: [PATCH] wayland/layershell: fix bridge destructor use after free on reload Under some conditions, Qt will recreate the layer surface. The layer surface destructor tries to destroy the bridge, but doesn't actually need to because the bridge is a child of the QWindow owning the layer, meaning not destroying it is actually completely fine. --- src/wayland/wlr_layershell/surface.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/wayland/wlr_layershell/surface.cpp b/src/wayland/wlr_layershell/surface.cpp index 3188c6b1..26d75587 100644 --- a/src/wayland/wlr_layershell/surface.cpp +++ b/src/wayland/wlr_layershell/surface.cpp @@ -174,7 +174,10 @@ LayerSurface::LayerSurface(LayerShellIntegration* shell, QtWaylandClient::QWayla } LayerSurface::~LayerSurface() { - delete this->bridge; + if (this->bridge && this->bridge->surface == this) { + this->bridge->surface = nullptr; + } + this->destroy(); }