Fix potential crash when destroying workspace

`_container_destroy` emits a destroy event, and any listener for this
event should have access to the full container, not a half destroyed
one.

`_container_destroy` also destroys the swayc, so we have to grab a
reference to the sway_workspace so we can free it afterwards.

This also fixes a memory leak where the floating container wasn't freed.

Fixes #2092.

1 files changed, 9 insertions, 1 deletions

diff --git a/sway/tree/container.c b/sway/tree/container.c
index 9e70da09..d0d26631 100644
--- a/sway/tree/container.c
+++ b/sway/tree/container.c
@@ -204,9 +204,17 @@ static struct sway_container *container_workspace_destroy(
                 }
         }
 
-        free(workspace->sway_workspace);
+        struct sway_workspace *sway_workspace = workspace->sway_workspace;
+
+        // This emits the destroy event and also destroys the swayc.
         _container_destroy(workspace);
 
+        // Clean up the floating container
+        sway_workspace->floating->parent = NULL;
+        _container_destroy(sway_workspace->floating);
+
+        free(sway_workspace);
+
         if (output) {
                 output_damage_whole(output->sway_output);
         }