From fcb4e9760a1f939beddad384bd491e588436fc4b Mon Sep 17 00:00:00 2001
From: nicm <nicm@openbsd.org>
Date: Sun, 20 Sep 2026 07:35:06 +0000
Subject: [PATCH] Reset layout manually instead of calling window_unzoom which
 can go down the notification path and end up double freeing the pane (this
 was previously removed in 2015 but added back to fix a problem with late
 destroy - this is a better fix). GitHub issue 5591 from Romain Francoise.

---
 window.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/window.c b/window.c
index e0ab51f19..bf6346788 100644
--- a/window.c
+++ b/window.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: window.c,v 1.374 2026/09/08 08:37:56 nicm Exp $ */
+/* $OpenBSD: window.c,v 1.375 2026/09/20 07:35:06 nicm Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicholas.marriott@gmail.com>
@@ -449,9 +449,17 @@ window_create(u_int sx, u_int sy, u_int xpixel, u_int ypixel)
 static void
 window_destroy(struct window *w)
 {
+	struct window_pane	*wp;
+
 	log_debug("window @%u destroyed (%d references)", w->id, w->references);
 
-	window_unzoom(w, 0);
+	if (w->flags & WINDOW_ZOOMED) {
+		w->flags &= ~WINDOW_ZOOMED;
+		TAILQ_FOREACH(wp, &w->panes, entry) {
+			wp->flags &= ~PANE_ZOOMED;
+			wp->saved_layout_cell = NULL;
+		}
+	}
 	RB_REMOVE(windows, &windows, w);
 
 	layout_free_cell(w->layout_root, 0);