Fix crash when disconnecting output

We were freeing the sway_output immediately upon disconnect which left
a dangling pointer in the output's container. It then tried to use the
pointer when the container is freed.

We don't need to store the sway_output in an output's container which is
destroying, so the fix is to set the pointer to NULL and remove the use
in container_free.

Also added an arrange when the output is disconnected for good measure.

2 files changed, 3 insertions, 1 deletions

diff --git a/sway/desktop/output.c b/sway/desktop/output.c
index 790751c3..34fefaa9 100644
--- a/sway/desktop/output.c
+++ b/sway/desktop/output.c
@@ -1271,6 +1271,8 @@ static void handle_destroy(struct wl_listener *listener, void *data) {
         wl_list_remove(&output->destroy.link);
         output->wlr_output->data = NULL;
         free(output);
+
+        arrange_and_commit(&root_container);
 }
 
 static void handle_mode(struct wl_listener *listener, void *data) {
diff --git a/sway/tree/container.c b/sway/tree/container.c
index e30c7839..2f041a36 100644
--- a/sway/tree/container.c
+++ b/sway/tree/container.c
@@ -171,7 +171,6 @@ void container_free(struct sway_container *cont) {
         case C_ROOT:
                 break;
         case C_OUTPUT:
-                cont->sway_output->swayc = NULL;
                 break;
         case C_WORKSPACE:
                 container_workspace_free(cont->sway_workspace);
@@ -287,6 +286,7 @@ static struct sway_container *container_output_destroy(
         wl_list_remove(&output->sway_output->damage_frame.link);
 
         output->sway_output->swayc = NULL;
+        output->sway_output = NULL;
 
         wlr_log(L_DEBUG, "OUTPUT: Destroying output '%s'", output->name);