From bc09504ea50901bedf945859bf7bd4c739e1ed38 Mon Sep 17 00:00:00 2001
From: jmanc3 <jman12316@live.com>
Date: Mon, 23 Feb 2026 10:58:06 -0600
Subject: [PATCH] desktop/popup: fix use after free in Popup (#13335)

m_alpha was freed by fullyDestroy, but was then being touched because setCallbackOnEnd is activated by tick, which is the same function that updates animating variables

---------

Co-authored-by: Vaxry <vaxry@vaxry.net>
---
 src/desktop/view/Popup.cpp | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/desktop/view/Popup.cpp b/src/desktop/view/Popup.cpp
index 58a16498..87c06e46 100644
--- a/src/desktop/view/Popup.cpp
+++ b/src/desktop/view/Popup.cpp
@@ -9,6 +9,7 @@
 #include "../../managers/animation/AnimationManager.hpp"
 #include "LayerSurface.hpp"
 #include "../../managers/input/InputManager.hpp"
+#include "../../managers/eventLoop/EventLoopManager.hpp"
 #include "../../render/Renderer.hpp"
 #include "../../render/OpenGL.hpp"
 #include <ranges>
@@ -108,8 +109,12 @@ void CPopup::initAllSignals() {
     m_alpha->setCallbackOnEnd(
         [this](auto) {
             if (inert()) {
-                g_pHyprRenderer->damageBox(CBox{coordsGlobal(), size()});
-                fullyDestroy();
+                g_pEventLoopManager->doLater([p = m_self] {
+                    if (!p)
+                        return;
+                    g_pHyprRenderer->damageBox(CBox{p->coordsGlobal(), p->size()});
+                    p->fullyDestroy();
+                });
             }
         },
         false);