Skip to content

fix: check for NULL view->container in constrain_popup to prevent segfault - #9206

Open
xieguaiwu wants to merge 1 commit into
swaywm:masterfrom
xieguaiwu:fix/constrain-popup-null-container
Open

fix: check for NULL view->container in constrain_popup to prevent segfault#9206
xieguaiwu wants to merge 1 commit into
swaywm:masterfrom
xieguaiwu:fix/constrain-popup-null-container

Conversation

@xieguaiwu

Copy link
Copy Markdown

When using an IME (Input Method Editor, e.g. fcitx, ibus, anthywl) with sway, closing a window while the IME candidate popup is still active can cause sway to crash with a segfault.

Root Cause

The crash occurs in constrain_popup() in sway/input/text_input.c:

  1. A view is unmapped and its container is freed (set to NULL)
  2. The IME popup still holds a reference to the destroyed view via popup->desc.view
  3. When the IME commits a new frame for the popup, handle_im_popup_surface_commit() calls constrain_popup()
  4. constrain_popup() accesses view->container->pending.content_x without checking if view->container is non-NULL → NULL pointer dereference → segfault

The Fix

Add a NULL guard for view->container before dereferencing it. If the container is NULL, the view is no longer valid and we return early rather than crashing.

Reproduction

  1. Configure sway with an IME (e.g., anthywl)
  2. Open any application with a text input (e.g., gedit, Firefox)
  3. Activate the IME so the candidate popup appears
  4. Close the window (e.g., via keyboard shortcut)
  5. Sway crashes with SIGSEGV in constrain_popup

Backtrace

#0  constrain_popup (popup=0x...) at ../sway-1.10/sway/input/text_input.c:159
#1  0x... in handle_im_popup_surface_commit (...)
#2  0x... in wl_signal_emit_mutable (wayland-server.c)
#3  0x... in surface_commit_state (wlroots)

Fixes #8541

@emersion

emersion commented Jul 1, 2026

Copy link
Copy Markdown
Member

This PR contains many unrelated commits.

…fault

When using an IME (Input Method Editor) like fcitx or anthywl, closing
a window while the IME popup (candidate window) is still active can
cause sway to crash with a segfault in constrain_popup().

The crash occurs because:
1. A view is unmapped and its container is freed (set to NULL)
2. The IME popup still holds a reference to the destroyed view via
   popup->desc.view
3. When the IME sends a new frame for the popup,
   handle_im_popup_surface_commit() calls constrain_popup()
4. constrain_popup() accesses view->container->pending.content_x
   without checking if view->container is non-NULL

Add a NULL check for view->container before dereferencing it. If the
container is NULL, the view is no longer valid and we return early
rather than crashing.

Fixes: swaywm#8541
@xieguaiwu
xieguaiwu force-pushed the fix/constrain-popup-null-container branch from 0831baa to 3024142 Compare July 3, 2026 09:37
@xieguaiwu

Copy link
Copy Markdown
Author

Branch has been rebased onto the latest upstream master. The history is now a single clean commit — no more unrelated commits.

/cc @emersion

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

Sway crashes when the window is closed while IME is active

2 participants