Wayland (glfw/wl_window.c):
- Fix out-of-bounds access in send_drag_data: look up item by MIME type
instead of using the data-request index i to index _glfw.drag.items[].
The compositor calls drag_source_send once per target window entered,
so _glfw.wl.drag.count grows independently of item_count, causing
_glfw.drag.items[i] to be out-of-bounds on the second drag, yielding a
garbage optional_data pointer that made write() fail with EFAULT.
- Fix protocol error "Drag has not ended": change on_fail and the
GLFW_DRAG_DATA_REQUEST error path to call finish_drag_write(i)+return
instead of cancel_drag(), which was calling wl_data_source_destroy()
before the compositor ended the drag, violating the Wayland protocol.
- Fix double-free of dr.pending_data: null the pointer after free and
add cleanup to finish_drag_write().
- Fix missing finish_drag_write() after a full write in data-request
mode, which left the pipe open causing the target to wait for EOF.
X11 (glfw/x11_window.c):
- Wrap XSendEvent() calls in send_xdnd_enter/position/leave/drop with
_glfwGrabErrorHandlerX11()/_glfwReleaseErrorHandlerX11(). A target
window destroyed between discovery and message delivery produced a
BadWindow error that hit the default X11 abort handler. Now handled
gracefully by clearing current_target or cancelling the drag."
Fixes#9677Fixes#9683
877be65447