@@ -1,6 +1,9 @@ 
-2017-12-21 master
+2017-12-29 master
 - Fixes:
+  - Fixed several use-after-free errors in the timer code
   - Merged patches and fixed other warnings on OpenBSD
+  - Task, Button, Executor: add a bit of slack in the pango text layout,
+    to avoid wrapping due to rounding errors
 
 2017-12-20 16.0
 - Fixes:

@@ -127,7 +127,7 @@ free(ac_connected_cmd);
     ac_connected_cmd = NULL;
     free(ac_disconnected_cmd);
     ac_disconnected_cmd = NULL;
-    stop_timer(&battery_timeout);
+    destroy_timer(&battery_timeout);
     battery_found = FALSE;
 
     battery_os_free();

@@ -65,6 +65,7 @@ time1_format = NULL;
     time1_timezone = NULL;
     time2_format = NULL;
     time2_timezone = NULL;
+    INIT_TIMER(clock_timeout);
     time_tooltip_format = NULL;
     time_tooltip_timezone = NULL;
     clock_lclick_command = NULL;
@@ -109,7 +110,7 @@ free(clock_uwheel_command);
     clock_uwheel_command = NULL;
     free(clock_dwheel_command);
     clock_dwheel_command = NULL;
-    stop_timer(&clock_timeout);
+    destroy_timer(&clock_timeout);
 }
 
 struct tm *clock_gettime_for_tz(const char *timezone)

@@ -41,6 +41,7 @@ execp->backend->interval = 30;
     execp->backend->cache_icon = TRUE;
     execp->backend->centered = TRUE;
     execp->backend->font_color.alpha = 0.5;
+    INIT_TIMER(execp->backend->timer);
     return execp;
 }
 
@@ -67,7 +68,7 @@ free_area(&execp->area);
         free_and_null(execp);
     } else {
         // This is a backend element
-        stop_timer(&execp->backend->timer);
+        destroy_timer(&execp->backend->timer);
 
         free_icon(execp->backend->icon);
         free_and_null(execp->backend->buf_stdout);

@@ -144,7 +144,7 @@ return;
 
     // Check every 0.5 seconds for up to 30 seconds
     detect_compositor_timer_counter = 60;
-    init_timer(&detect_compositor_timer, "detect_compositor_timer");
+    INIT_TIMER(detect_compositor_timer);
     change_timer(&detect_compositor_timer, true, 500, 500, detect_compositor, 0);
 }
 

@@ -145,7 +145,7 @@ p->hidden_pixmap = 0;
         if (p->main_win)
             XDestroyWindow(server.display, p->main_win);
         p->main_win = 0;
-        stop_timer(&p->autohide_timeout);
+        destroy_timer(&p->autohide_timeout);
         cleanup_freespace(p);
     }
 
@@ -207,6 +207,7 @@ 
     panels = calloc(num_panels, sizeof(Panel));
     for (int i = 0; i < num_panels; i++) {
         memcpy(&panels[i], &panel_config, sizeof(Panel));
+        INIT_TIMER(panels[i].autohide_timeout);
     }
 
     fprintf(stderr,

@@ -730,6 +730,8 @@ // to prevent graphical corruptions in icons with fake transparency
     traywin->pid = pid;
     traywin->name = name;
     traywin->chrono = chrono;
+    INIT_TIMER(traywin->render_timeout);
+    INIT_TIMER(traywin->resize_timeout);
     chrono++;
 
     show(&systray.area);
@@ -940,8 +942,8 @@ XReparentWindow(server.display, traywin->win, server.root_win, 0, 0);
     XDestroyWindow(server.display, traywin->parent);
     XSync(server.display, False);
     XSetErrorHandler(old);
-    stop_timer(&traywin->render_timeout);
-    stop_timer(&traywin->resize_timeout);
+    destroy_timer(&traywin->render_timeout);
+    destroy_timer(&traywin->resize_timeout);
     free(traywin->name);
     if (traywin->image) {
         imlib_context_set_image(traywin->image);

@@ -44,6 +44,9 @@ {
     // give the tooltip some reasonable default values
     memset(&g_tooltip, 0, sizeof(Tooltip));
 
+    INIT_TIMER(g_tooltip.timeout);
+    INIT_TIMER(g_tooltip.update_timeout);
+
     g_tooltip.font_color.rgb[0] = 1;
     g_tooltip.font_color.rgb[1] = 1;
     g_tooltip.font_color.rgb[2] = 1;
@@ -54,7 +57,8 @@ 
 void cleanup_tooltip()
 {
     stop_tooltip_timeout();
-    stop_timer(&g_tooltip.update_timeout);
+    destroy_timer(&g_tooltip.timeout);
+    destroy_timer(&g_tooltip.update_timeout);
     tooltip_hide(NULL);
     tooltip_update_contents_for(NULL);
     if (g_tooltip.window)