wayland/toplevel: defer Toplevel/handle destruction to avoid use-after-free

changelog/next.md

@@ -6,3 +6,4 @@
 - Fixed missing/wrong change signals on various properties.
 - Fixed session lock crashes on sleep, wake, DPMS, and unlocking.
 - QsWindow.updatesEnabled makes sure windows are redrawn when set to true.
+- Fixed a crash that could occur when a Toplevel was closed while still referenced, such as on monitor wakeup.

src/wayland/toplevel/qml.cpp

@@ -31,7 +31,7 @@ Toplevel::Toplevel(wlr::ToplevelHandle* handle, QObject* parent): QObject(parent
 
 void Toplevel::onClosed() {
 	emit this->closed();
-	delete this;
+	this->deleteLater();
 }
 
 void Toplevel::activate() { this->handle->activate(); }

src/wayland/toplevel/wlr_toplevel.cpp

@@ -173,7 +173,7 @@ void ToplevelHandle::zwlr_foreign_toplevel_handle_v1_closed() {
 	qCDebug(logToplevelManagement) << this << "closed";
 	this->destroy();
 	emit this->closed();
-	delete this;
+	this->deleteLater();
 }
 
 void ToplevelHandle::zwlr_foreign_toplevel_handle_v1_app_id(const QString& appId) {

src/wayland/toplevel/wlr_toplevel.hpp

@@ -45,7 +45,8 @@ class ToplevelHandle
 signals:
 	// sent after the first done event.
 	void ready();
-	// sent right before delete this.
+	// sent right before this object is scheduled for deletion (via deleteLater)
+	// -- the wayland handle is already gone by this point.
 	void closed();
 
 	void appIdChanged();