fix(tmux): use-after-free in receivedListWindows action slice

[daiimus]

Summary

receivedListWindows stores windows.items — a slice into a local std.ArrayList(Window) — directly into the action list. The ArrayList is freed by defer windows.deinit(self.alloc) on function return, leaving the action holding a dangling pointer.

Currently latent: consumers only read .len (inline in the fat pointer), not the pointed-to data. Becomes a live crash when anything iterates action.windows[i].

Fix

Dupe the slice into the arena allocator so it shares the action list's lifetime:

const arena_windows = try arena_alloc.dupe(Window, windows.items); try actions.append(arena_alloc, .{ .windows = arena_windows });

Test

Added "list-windows action data survives function return" — runs through the startup sequence and dereferences action.windows[0].id, .width, .height in the check callback. Reads freed memory without the fix.

AI Disclosure

Bug was identified and fix was authored with Claude Code assistance. I understand the root cause: the local ArrayList's .items slice becomes invalid after deinit, but was stored into the action struct that outlives the function scope. The fix copies into the arena that backs all actions.

[Copilot]

Pull request overview

This PR fixes a use-after-free bug in the tmux viewer's receivedListWindows function. Previously, windows.items — a slice backed by a local std.ArrayList — was stored directly into the action list. Since the ArrayList is freed by a defer when the function returns, this left the action holding a dangling pointer. The fix duplicates the slice into the arena allocator that backs the action list, ensuring the data survives the function return.

Changes:

• Duplicate windows.items into arena_alloc before appending to the action list, preventing a use-after-free
• Added a regression test that exercises the full startup-to-list-windows flow and validates that window data in the action is accessible after the function returns

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mitchellh]

I have to check in more detail, but on first pass this doesn't seem right. Why not change windows to be on the arena, possibly layout too so it's not in its own arena but using the shared arena?

Please explain your thinking, not the agents.