Crash: dwindle assert from dragEnd() when dragBegin() rejects a drag, via stale m_draggingTiled

[flashback7766]

Version: 0.56.2, commit efb50993780079460b0cbed1363e2166a2de1d9f, tag v0.56.2 (Arch hyprland 0.56.2-1)
GPU: AMD Radeon 680M (Rembrandt), amdgpu
Layout: dwindle

What happens

Hyprland dies with SIGSEGV on an assert while dragging a window with a mouse bind (SUPER + mouse:272 → hl.dsp.window.drag()). It is intermittent — I have two crashes with this signature and no reliable trigger, so the report is based on reading the code rather than on a recipe.

Backtrace (relevant frames, top first)

assertImpl<unsigned int&, int>(...)
Layout::Tiled::CDwindleAlgorithm::movedTarget(SP<ITarget>, std::optional<Vector2D>)
Layout::CAlgorithm::moveTarget(SP<ITarget>, std::optional<Vector2D>, bool)
Layout::CAlgorithm::setFloating(SP<ITarget>, bool, bool)
Layout::CSpace::toggleTargetFloating(SP<ITarget>)
Layout::CLayoutManager::changeFloatingMode(SP<ITarget>)
Layout::Supplementary::CDragStateController::dragEnd()
CKeybindManager::changeMouseBindMode(eMouseBindMode)      <-- second entry
Layout::Supplementary::CDragStateController::dragBegin(SP<ITarget>, eMouseBindMode, std::optional<eRectCorner>, bool)
Layout::CLayoutManager::beginDragTarget(SP<ITarget>, eMouseBindMode, std::optional<eRectCorner>, bool)
CKeybindManager::changeMouseBindMode(eMouseBindMode)      <-- first entry
Config::Actions::mouse(std::string const&)
CKeybindManager::handleKeybinds(...)

changeMouseBindMode appears twice: it calls dragBegin(), and dragBegin() calls it straight back, which runs dragEnd() for a drag that never finished starting.

Analysis

m_draggingTiled is only ever cleared inside updateDragWindow(), and dragBegin() has three early returns that never reach it.

src/layout/supplementary/DragController.cpp:

• 102 — m_draggingTiled = false; (the only reset, inside updateDragWindow())
• 115 — m_draggingTiled = true; after changeFloatingMode() floats a tiled window
• 275–279 — dragEnd() reads it:

  if (m_draggingTiled) {
      if (draggingTarget->floating())
          g_layoutManager->changeFloatingMode(draggingTarget);
      draggingTarget->rememberFloatingSize(m_draggingWindowOriginalFloatSize);
  }

• 288–295 — dragEnd()'s teardown resets m_wasDraggingWindow, m_dragMode, m_exclusiveDeviceGrab and m_forcedGrabbedCorner, but not m_draggingTiled.

So the flag survives a completed drag and stays true until the next updateDragWindow() clears it. Meanwhile dragBegin() bails out before that point in three places, each calling changeMouseBindMode(MBIND_INVALID) → dragEnd():

• 143–147 — window not mapped
• 149–153 — no workspace
• 97–99 (inside updateDragWindow(), above the reset at 102) — drag rejected on a fullscreen workspace

On any of those, dragEnd() runs with m_draggingTiled left over from the previous drag and calls changeFloatingMode() on a window this drag never floated. In dwindle that reaches movedTarget() → addTarget() with the node tree in a state it does not expect, and the assert fires.

The first two paths are the more likely ones in practice: they are exactly what a drag started on a window that is mid-unmap or has just changed workspace will hit.

Suggested fix

Make the flag per-drag rather than per-updateDragWindow(). Either of these closes it; doing both is cheap:

1. Initialise it with the rest of the drag state at the top of dragBegin() (alongside lines 130–134, before the early returns at 143 and 149):

   m_draggingTiled = false;

2. Clear it in dragEnd()'s teardown for symmetry, next to the other resets at 292–295:

   m_draggingTiled = false;

A stricter alternative would be to have dragBegin()'s failure paths do their own minimal cleanup instead of re-entering changeMouseBindMode(), so dragEnd() is never called for a drag that never began — that also removes the re-entrancy the backtrace shows, but it is a larger change.

Two smaller things noticed in the same file

• dragEnd() line 222 does auto draggingTarget = m_target.lock(); and dereferences it at 226 (draggingTarget->window()) with no null check.
• dragBegin() line 136 does the same with DRAGGINGTARGET and dereferences it at 143.

Both are reachable if m_target is empty or expired at that moment.

[vaxerski]

tnx #15833