refactor: remove manual timer resets from event loop callbacks in Fcitx5 module - #57
refactor: remove manual timer resets from event loop callbacks in Fcitx5 module#57yvonshong wants to merge 1 commit into
Conversation
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
…ling and removing redundant internal resets
0e3237a to
a7c0d4f
Compare
|
Thanks for the PR. The reported root cause is real, and your report helped us trace the timer ownership problem. I am closing this PR rather than merging it as-is because simply removing the callback-side resets changes an important invariant: polling/animation paths need the timer member to become empty while the callback is running so they can reschedule safely. In particular, moving the reset into schedulePanelAnimationFrame() can still destroy the currently executing timer when that function is called recursively from its callback. The PR also contains unrelated key-cancellation behavior changes that should not be coupled to this fix. The timer UAF is fixed on master in commit 207df16 using a callback-local ownership keepalive: the member is cleared immediately, while the executing EventSourceTime/closure stays alive through the rest of the callback. A real Fcitx EventLoop regression test was added as well. Thank you for identifying the bug and contributing the patch. |
Title
fix(fcitx5): fix SIGSEGV crash caused by resetting EventSourceTime timer inside its own
callback
Description
Fcitx5 would crash with
Signal 11 (SIGSEGV)atvocotype.so.ptt_hold_timer_,recording_animation_timer_,voice_edit_poll_timer_,polish_poll_timer_,edit_hint_timer_) calledtimer_.reset()inside their own Lambda callback.that holds the running Lambda closure, triggering a Use-After-Free and crashing the Fcitx5 host
process.
returning
falseare properly managed and cleaned up by Fcitx5's event loop.