Fix potential crash when destroying workspace

`_container_destroy` emits a destroy event, and any listener for this
event should have access to the full container, not a half destroyed
one.

`_container_destroy` also destroys the swayc, so we have to grab a
reference to the sway_workspace so we can free it afterwards.

This also fixes a memory leak where the floating container wasn't freed.

Fixes #2092.

1 files changed, 9 insertions, 1 deletions

diff --git a/sway/tree/container.c b/sway/tree/container.c
index 9e70da09..d0d26631 100644
--- a/sway/tree/container.c
+++ b/sway/tree/container.c
@@ -204,9 +204,17 @@ static struct sway_container *container_workspace_destroy(
 		}
 	}
 
-	free(workspace->sway_workspace);
+	struct sway_workspace *sway_workspace = workspace->sway_workspace;
+
+	// This emits the destroy event and also destroys the swayc.
 	_container_destroy(workspace);
 
+	// Clean up the floating container
+	sway_workspace->floating->parent = NULL;
+	_container_destroy(sway_workspace->floating);
+
+	free(sway_workspace);
+
 	if (output) {
 		output_damage_whole(output->sway_output);
 	}