Problem
wmenu sometimes crashes on startup under Wayland with a segfault in xkb_state_update_mask() which appears similar to this slurp issue. In both cases, the top frame is xkb_state_update_mask(), suggesting that a Wayland keyboard modifier event is being handled before the client has a valid xkb_state.
Crash log
May 23 23:07:43 Inspiron5409 systemd-coredump[2886988]: Process 2886983 (wmenu) of user 1000 dumped core.
Stack trace of thread 2886983:
#0 0x00007fca6a94fe44 xkb_state_update_mask (libxkbcommon.so.0 + 0x3de44)
#1 0x00007fca69f175e6 n/a (libffi.so.8 + 0x85e6)
#2 0x00007fca69f13acf n/a (libffi.so.8 + 0x4acf)
#3 0x00007fca69f1690e ffi_call (libffi.so.8 + 0x790e)
#4 0x00007fca6a98383f n/a (libwayland-client.so.0 + 0x483f)
#5 0x00007fca6a984895 n/a (libwayland-client.so.0 + 0x5895)
#6 0x00007fca6a984cd3 wl_display_dispatch_queue_pending (libwayland-client.so.0 + 0x5cd3)
#7 0x00007fca6a98933e wl_display_dispatch_queue_timeout (libwayland-client.so.0 + 0xa33e)
#8 0x00007fca6a989430 wl_display_dispatch_queue (libwayland-client.so.0 + 0xa430)
#9 0x000055b337870c7a n/a (/usr/bin/wmenu + 0x3c7a)
#10 0x00007fca6a627741 n/a (libc.so.6 + 0x27741)
#11 0x00007fca6a627879 __libc_start_main (libc.so.6 + 0x27879)
#12 0x000055b337870e65 n/a (/usr/bin/wmenu + 0x3e65)
Stack trace of thread 2886986:
#0 0x00007fca6a71af9d syscall (libc.so.6 + 0x11af9d)
#1 0x00007fca69ff646e g_cond_wait (libglib-2.0.so.0 + 0xaa46e)
#2 0x00007fca69f74a0d g_async_queue_pop (libglib-2.0.so.0 + 0x28a0d)
#3 0x00007fca69efbc6c n/a (libpangoft2-1.0.so.0 + 0xcc6c)
#4 0x00007fca69fff344 n/a (libglib-2.0.so.0 + 0xb3344)
#5 0x00007fca6a6981b9 n/a (libc.so.6 + 0x981b9)
#6 0x00007fca6a71d21c n/a (libc.so.6 + 0x11d21c)
ELF object binary architecture: AMD x86-64
Likely cause
keyboard->state is initialized in the keyboard keymap handler, but the keyboard key/modifier handlers appear to use it without checking whether it is non-NULL.
The problematic path is likely:
xkb_state_update_mask(keyboard->state, mods_depressed, mods_latched,
mods_locked, 0, 0, group);
If keyboard->state is still NULL, or if xkb_state_new() failed earlier, this can crash.
Suggested fix
As suggested in this fix for slurp, adding NULL checks around uses of keyboard->state, especially in keyboard_key(), keyboard_modifiers(), keyboard_repeat(), may be a useful fix for this issue
Environment
- wmenu 0.2.0
- sway version 1.11, wayland
- archlinux 2026年5月16日
# Problem
`wmenu` sometimes crashes on startup under Wayland with a segfault in `xkb_state_update_mask()` which appears similar to [this slurp issue](https://github.com/emersion/slurp/issues/181). In both cases, the top frame is `xkb_state_update_mask()`, suggesting that a Wayland keyboard modifier event is being handled before the client has a valid `xkb_state`.
Crash log
```text
May 23 23:07:43 Inspiron5409 systemd-coredump[2886988]: Process 2886983 (wmenu) of user 1000 dumped core.
Stack trace of thread 2886983:
#0 0x00007fca6a94fe44 xkb_state_update_mask (libxkbcommon.so.0 + 0x3de44)
#1 0x00007fca69f175e6 n/a (libffi.so.8 + 0x85e6)
#2 0x00007fca69f13acf n/a (libffi.so.8 + 0x4acf)
#3 0x00007fca69f1690e ffi_call (libffi.so.8 + 0x790e)
#4 0x00007fca6a98383f n/a (libwayland-client.so.0 + 0x483f)
#5 0x00007fca6a984895 n/a (libwayland-client.so.0 + 0x5895)
#6 0x00007fca6a984cd3 wl_display_dispatch_queue_pending (libwayland-client.so.0 + 0x5cd3)
#7 0x00007fca6a98933e wl_display_dispatch_queue_timeout (libwayland-client.so.0 + 0xa33e)
#8 0x00007fca6a989430 wl_display_dispatch_queue (libwayland-client.so.0 + 0xa430)
#9 0x000055b337870c7a n/a (/usr/bin/wmenu + 0x3c7a)
#10 0x00007fca6a627741 n/a (libc.so.6 + 0x27741)
#11 0x00007fca6a627879 __libc_start_main (libc.so.6 + 0x27879)
#12 0x000055b337870e65 n/a (/usr/bin/wmenu + 0x3e65)
Stack trace of thread 2886986:
#0 0x00007fca6a71af9d syscall (libc.so.6 + 0x11af9d)
#1 0x00007fca69ff646e g_cond_wait (libglib-2.0.so.0 + 0xaa46e)
#2 0x00007fca69f74a0d g_async_queue_pop (libglib-2.0.so.0 + 0x28a0d)
#3 0x00007fca69efbc6c n/a (libpangoft2-1.0.so.0 + 0xcc6c)
#4 0x00007fca69fff344 n/a (libglib-2.0.so.0 + 0xb3344)
#5 0x00007fca6a6981b9 n/a (libc.so.6 + 0x981b9)
#6 0x00007fca6a71d21c n/a (libc.so.6 + 0x11d21c)
ELF object binary architecture: AMD x86-64
```
# Likely cause
`keyboard->state` is initialized in the keyboard keymap handler, but the keyboard key/modifier handlers appear to use it without checking whether it is non-NULL.
The problematic path is likely:
```C
xkb_state_update_mask(keyboard->state, mods_depressed, mods_latched,
mods_locked, 0, 0, group);
```
If `keyboard->state` is still NULL, or if `xkb_state_new()` failed earlier, this can crash.
# Suggested fix
As suggested in [this fix for slurp](https://github.com/emersion/slurp/pull/190), adding NULL checks around uses of keyboard->state, especially in `keyboard_key()`, `keyboard_modifiers()`, `keyboard_repeat()`, may be a useful fix for this issue
# Environment
- wmenu 0.2.0
- sway version 1.11, wayland
- archlinux 2026年5月16日