Skip to content

Fix segfault when input events arrive during initialization#190

Open
Yiin wants to merge 1 commit intoemersion:masterfrom
Yiin:fix-segfault-during-init
Open

Fix segfault when input events arrive during initialization#190
Yiin wants to merge 1 commit intoemersion:masterfrom
Yiin:fix-segfault-during-init

Conversation

@Yiin
Copy link

@Yiin Yiin commented Feb 11, 2026

Summary

Fixes the segfault reported in #181 caused by pointer/keyboard events arriving before cursor surfaces and xkb state are initialized.

  • Move cursor_surface creation and cursor theme loading before the second wl_display_roundtrip(), which is the first point where the compositor dispatches input events via newly-created layer surfaces
  • Add defensive NULL checks in pointer_handle_enter, keyboard_handle_key, and keyboard_handle_modifiers as a safety net

Root cause

During initialization, seat listeners are registered in the first roundtrip (via handle_globalcreate_seat), but cursor_surface is only created after the second roundtrip. When the compositor sends a pointer_enter event during that second roundtrip (triggered by the layer surfaces committing), pointer_handle_enter dereferences a NULL cursor_surface inside wl_surface_set_buffer_scale() or wp_cursor_shape_manager_v1_get_pointer().

The same class of bug affects keyboard_handle_key and keyboard_handle_modifiers, which can dereference NULL xkb_state if a keyboard event arrives before the keymap event.

Reproduction

The race is timing-dependent but becomes nearly deterministic with many outputs (e.g. 45+ headless virtual monitors on Hyprland), as the roundtrip takes longer to enumerate all outputs, widening the window for events to arrive before initialization completes. Using wayfreeze --after-freeze-cmd "slurp ..." also exacerbates it since slurp immediately inherits pointer focus.

Crash backtrace:

#0  wl_proxy_get_version (libwayland-client.so.0)
#1  pointer_handle_enter (slurp)
...
#10 wl_display_roundtrip_queue (libwayland-client.so.0)
#11 main (slurp)

Fixes #181

Move cursor surface creation and cursor theme loading before the second
wl_display_roundtrip(), which is the first point where the compositor
can dispatch pointer_enter or keyboard events to slurp via the
newly-created layer surfaces.

Previously, cursor_surface was created after the roundtrip, so
pointer_handle_enter could call wl_surface_set_buffer_scale() or
wp_cursor_shape_manager_v1_get_pointer() with a NULL surface. Similarly,
keyboard_handle_key and keyboard_handle_modifiers could dereference NULL
xkb_state if a keyboard event arrived before the keymap event.

This race is especially pronounced on setups with many outputs (e.g.
headless virtual monitors), where the roundtrip takes longer due to
output enumeration, widening the window for events to arrive before
initialization completes.

Also add defensive NULL checks in the affected handlers as a safety net.

Fixes: emersion#181
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Segfault occurs sometimes

1 participant