Segfault in --verify-config when a config uses hl.timer()

[QubnexLab]

Summary

--verify-config segfaults on any Lua config that calls hl.timer(). It dies in
CEventLoopManager::removeTimer() during teardown, because in verify mode the
global event loop manager is never constructed but is still dereferenced.

This is the same defect class as #15405 (layout providers), but on the timer
teardown path. Appears unfixed on main as of today.

Version

• Hyprland: 0.56.2 (Arch hyprland 0.56.2-2), latest release
• Also reproduces on main (commit as of 2026-10-15) — line 505 of
  src/config/lua/ConfigManager.cpp is unchanged

Reproduction

sigsegv.lua:

hl.timer(function() end, { timeout = 100, type = "oneshot" })

$ hyprland --verify-config -c sigsegv.lua
Segmentation fault (core dumped)

Control case — confirms the trigger

Same config, timer line removed:

local x = 1 + 1

$ hyprland --verify-config -c control.lua

======== Config parsing result:

config ok
$ echo $?
0

So the hl.timer() call alone is sufficient to trigger it. type = "repeat"
and a timer that is immediately set_enabled(false) behave identically — the
crash happens in teardown regardless of timer mode or whether it ever fires.

Backtrace

           PID: 19647 (hyprland)
           TID: 19647 (hyprland)
        Signal: 11 (SEGV) si_code: SEGV_MAPERR
  Command Line: hyprland --verify-config -c repro-timer.lua
    Executable: /usr/bin/Hyprland

                Stack trace of thread 19647:
                #0  CEventLoopManager::removeTimer(Hyprutils::Memory::CSharedPointer<CEventLoopTimer>) ()
                #1  Config::Lua::CConfigManager::cleanTimers() ()
                #2  Config::Lua::CConfigManager::~CConfigManager() ()
                #3  Config::Lua::CConfigManager::~CConfigManager() ()
                #4  Hyprutils::Memory::CUniquePointer<Config::IConfigManager>::decrement() ()
                #5  main ()
                #6  n/a (libc.so.6 + 0x27781)
                #7  __libc_start_main (libc.so.6 + 0x278b9)
                #8  _start (Hyprland + 0x3a55e5)

SEGV_MAPERR with no other threads in the process.

Root cause

CCompositor::initServer() (src/Compositor.cpp) returns early in verify mode,
before initManagers(STAGE_PRIORITY) runs — and that is what constructs the
event loop manager:

void CCompositor::initServer(std::string socketName, int socketFd) {
    if (m_onlyConfigVerification) {
        g_pKeybindManager = makeUnique<CKeybindManager>();
        Animation::mgr();
        Config::initConfigManager();
        Config::mgr()->init();
        std::println("\n\n======== Config parsing result:\n\n{}", Config::mgr()->verify());
        return;                        // <-- early return
    }
    ...
    initManagers(STAGE_PRIORITY);      // <-- creates g_pEventLoopManager (line 647)

main() then resets the config manager, whose destructor tears the timers down
(src/main.cpp):

if (verifyConfig) {
    const auto verify = Config::mgr()->configVerifPassed();
    Config::mgr().reset();            // -> ~CConfigManager -> cleanTimers()
    return !verify;
}

cleanTimers() calls through the global that was never created
(src/config/lua/ConfigManager.cpp):

void CConfigManager::cleanTimers() {
    for (auto& t : m_luaTimers) {
        t.timer->cancel();                            // touches only the timer object — survives
        g_pEventLoopManager->removeTimer(t.timer);    // <-- g_pEventLoopManager is null

g_pEventLoopManager is a null CUniquePointer, so this is a null dereference.
It only triggers when m_luaTimers is non-empty, i.e. when the config actually
created at least one timer — which is why most configs verify fine.

There is a related variant that crashes slightly earlier, during config load
rather than teardown, when a timer is created and something schedules a recalc:

#0  CEventLoopManager::scheduleRecalc() ()
...
#8  Config::Lua::CConfigManager::guardedPCall(...)
#9  Config::Lua::CConfigManager::reload() ()
#10 CCompositor::initServer(...) ()

Same underlying cause: null g_pEventLoopManager in verify mode.

Proposed fix

Guard the call in cleanTimers():

if (g_pEventLoopManager)
    g_pEventLoopManager->removeTimer(t.timer);

scheduleRecalc() has the same exposure and would want the same treatment.
Alternatively, constructing the CEventLoopManager before the
m_onlyConfigVerification early return would fix the whole class at once, since
it is the only manager that path assumes exists.

Note the normal (non-verify) shutdown path is not affected, and appears to be
safe by ordering alone: CCompositor::cleanup() resets Config::mgr() at line
616 but g_pEventLoopManager at line 625, so teardown still has a live manager.
Only the verify path resets the config manager without one.

Impact

--verify-config is unusable as a config validator on any config that uses
hl.timer(). This affects shipped defaults, not just hand-written configs — e.g.
Omarchy's default/hypr/bindings/clipboard.lua creates a oneshot timer, so
hyprland --verify-config segfaults on a stock Omarchy config too.

Filed by Space Bunny Free via OpenCode.

[github-actions[bot]]

This discussion has been automatically closed.
Discussion format is NOT optional!

[github-actions[bot]]

⚠️ Strike 1/3 issued to @sachingubhaju by system.