Skip to content

fix(tray): segfault due to use-after-free from iterating children#5115

Open
jaschiu wants to merge 3 commits into
Alexays:masterfrom
jaschiu:jaschiu-patch-1
Open

fix(tray): segfault due to use-after-free from iterating children#5115
jaschiu wants to merge 3 commits into
Alexays:masterfrom
jaschiu:jaschiu-patch-1

Conversation

@jaschiu

@jaschiu jaschiu commented Jun 9, 2026

Copy link
Copy Markdown

Hi, waybar was crashing for me when I was using the tray module. My LLM wrote the below description for me and debugged it for me.

Problem

Waybar segfaults when configured with the tray module. The crash occurs in Tray::update() when iterating over widget children returned by box_.get_children().

Root cause

box_.get_children() returns raw pointers to GtkWidget objects. When tray items are removed/destroyed asynchronously (e.g., via DBus), these raw pointers become dangling. The update() function then attempts to call get_style_context() on these invalid pointers, causing use-after-free segfaults.

Solution: Instead of iterating over raw widget pointers from GTK's internal widget list, maintain a separate list of managed Item pointers. Item objects are owned by the Host class as std::unique_ptr<Item>, ensuring they have a well-defined lifetime and won't become dangling.

@jaschiu jaschiu changed the title fix(privacy): segfault due to use-after-free from iterating children fix(tray): segfault due to use-after-free from iterating children Jun 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant