From f047b3f8e70f42128501bf20c2bcfc1b3284d792 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Sun, 24 May 2026 08:40:43 +0000
Subject: [PATCH] Do not crash when freeing layout cell, reported by Jere
 Viikari.

---
 layout-custom.c | 3 +--
 layout.c        | 3 +++
 screen-redraw.c | 2 +-
 window.c        | 6 ++----
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/layout-custom.c b/layout-custom.c
index 6c4881ce..b2871f0d 100644
--- a/layout-custom.c
+++ b/layout-custom.c
@@ -304,8 +304,7 @@ layout_parse(struct window *w, const char *layout, char **cause)
 	layout_print_cell(tiled_lc, __func__, 0);
 
 	/* Free the floating layout cell, no longer needed. */
-	if (floating_lc != NULL)
-		layout_free_cell(floating_lc);
+	layout_free_cell(floating_lc);
 
 	notify_window("window-layout-changed", w);
 
diff --git a/layout.c b/layout.c
index 5ecad949..8ee80261 100644
--- a/layout.c
+++ b/layout.c
@@ -78,6 +78,9 @@ layout_free_cell(struct layout_cell *lc)
 {
 	struct layout_cell	*lcchild;
 
+	if (lc == NULL)
+		return;
+
 	switch (lc->type) {
 	case LAYOUT_LEFTRIGHT:
 	case LAYOUT_TOPBOTTOM:
diff --git a/screen-redraw.c b/screen-redraw.c
index 996c7ff0..020466c6 100644
--- a/screen-redraw.c
+++ b/screen-redraw.c
@@ -1273,7 +1273,7 @@ screen_redraw_draw_pane(struct screen_redraw_ctx *ctx, struct window_pane *wp)
 	struct screen		*s = wp->screen;
 	struct colour_palette	*palette = &wp->palette;
 	struct grid_cell	 defaults;
-	u_int			 i, j, woy, wx, wy, px, py, width;
+	u_int			 i, j, woy, wx, wy, py, width;
 	struct visible_ranges	*r;
 	struct visible_range	*ri;
 
diff --git a/window.c b/window.c
index e6e6eba7..1d9e84f9 100644
--- a/window.c
+++ b/window.c
@@ -349,10 +349,8 @@ window_destroy(struct window *w)
 	window_unzoom(w, 0);
 	RB_REMOVE(windows, &windows, w);
 
-	if (w->layout_root != NULL)
-		layout_free_cell(w->layout_root);
-	if (w->saved_layout_root != NULL)
-		layout_free_cell(w->saved_layout_root);
+	layout_free_cell(w->layout_root);
+	layout_free_cell(w->saved_layout_root);
 	free(w->old_layout);
 
 	window_destroy_panes(w);