ui: harden modal widget user_data handling

Replace function-pointer-in-userdata pattern with a data context struct.

Author: kristapsk

src/ui/ui.zig

@@ -32,6 +32,7 @@ pub const InitOpt = struct {
 pub fn init(opt: InitOpt) !void {
     allocator = opt.allocator;
     settings.allocator = opt.allocator;
+    widget.allocator = opt.allocator;
     lvgl.init();
     const disp = try drv.initDisplay();
     drv.initInput() catch |err| {

src/ui/widget.zig

@@ -3,6 +3,9 @@ const lvgl = @import("lvgl.zig");
 
 const logger = std.log.scoped(.ui);
 
+// NOTE: ui.init() must set this (e.g. widget.allocator = opt.allocator).
+pub var allocator: std.mem.Allocator = undefined;
+
 // defined in ui.c
 extern fn nm_keyboard_popon(input: *lvgl.LvObj) void;
 extern fn nm_keyboard_popoff() void;
@@ -60,18 +63,34 @@ pub fn topdrop(onoff: enum { show, remove }) void {
 /// provided as btns arg to modal.
 pub const ModalButtonCallbackFn = *const fn (index: usize) void;
 
+/// Context stored in the modal window's user data.
+/// We intentionally store a *data pointer* in LVGL user_data (void*), never a function
+/// pointer, because data-pointer <-> function-pointer casts are not portable and can
+/// break across Zig versions / ABIs.
+///
+/// We also store the allocator used to allocate this context so the delete handler
+/// can always free with the same allocator.
+const ModalCtx = struct {
+    alloc: std.mem.Allocator,
+    cb: ModalButtonCallbackFn,
+};
+
 /// shows a non-dismissible window using the whole screen real estate;
 /// for use in place of lv_msgbox_create.
 ///
 /// while all heap-alloc'ed resources are free'd automatically right before cb is called,
 /// the value of title, text and btns args must live at least as long as cb; they are
 /// memory-managed by the callers.
-///
-/// note: the cb callback must have @alignOf(ModalbuttonCallbackFn) alignment.
 pub fn modal(title: [*:0]const u8, text: [*:0]const u8, btns: []const [*:0]const u8, cb: ModalButtonCallbackFn) !void {
     const win = try lvgl.Window.newTop(60, title);
     errdefer win.destroy(); // also deletes all children created below
-    win.setUserdata(cb);
+
+    const ctx = try allocator.create(ModalCtx);
+    ctx.* = .{ .alloc = allocator, .cb = cb };
+    win.setUserdata(ctx);
+
+    // Free context when the window is deleted, regardless of deletion path.
+    _ = win.on(.delete, nm_modal_delete_callback, null);
 
     const wincont = win.content().flex(.column, .{ .cross = .center, .track = .center });
     const msg = try lvgl.Label.new(wincont, text, .{ .pos = .center });
@@ -89,7 +108,10 @@ pub fn modal(title: [*:0]const u8, text: [*:0]const u8, btns: []const [*:0]const
         const btn = try lvgl.TextButton.new(btncont, btext);
         btn.setFlag(.event_bubble);
         btn.setFlag(.user1); // .user1 indicates actionable button in callback
-        btn.setUserdata(@ptrFromInt(i)); // button index in callback
+
+        // Store (i+1) so userdata is never null (0). In callback: idx = intFromPtr - 1.
+        btn.setUserdata(@ptrFromInt(i + 1));
+
         btn.setWidth(btnwidth);
         if (i == 0) {
             btn.addStyle(lvgl.nm_style_btn_red(), .{});
@@ -98,17 +120,38 @@ pub fn modal(title: [*:0]const u8, text: [*:0]const u8, btns: []const [*:0]const
     _ = btncont.on(.click, nm_modal_callback, win.lvobj);
 }
 
+/// Frees modal context when the window is deleted. This runs for all deletion paths
+/// (button click, screen unload, parent cleanup, etc.) and avoids leaks/double-frees.
+export fn nm_modal_delete_callback(e: *lvgl.LvEvent) callconv(.C) void {
+    const win = lvgl.Window{ .lvobj = e.target() };
+
+    const ctx_any = win.userdata() orelse return;
+    const ctx: *ModalCtx = @ptrCast(@alignCast(ctx_any));
+
+    // Clear userdata so any accidental future access becomes a null-check failure.
+    win.setUserdata(null);
+
+    ctx.alloc.destroy(ctx);
+}
+
 export fn nm_modal_callback(e: *lvgl.LvEvent) callconv(.C) void {
-    if (e.userdata()) |edata| {
-        const target = lvgl.Container{ .lvobj = e.target() }; // type doesn't really matter
-        if (!target.hasFlag(.user1)) { // .user1 is set in modal setup
-            return;
-        }
+    const edata = e.userdata() orelse return;
 
-        const btn_index = @intFromPtr(target.userdata());
-        const win = lvgl.Window{ .lvobj = @ptrCast(edata) };
-        const cb: ModalButtonCallbackFn = @alignCast(@ptrCast(win.userdata()));
-        win.destroy();
-        cb(btn_index);
+    const target = lvgl.Container{ .lvobj = e.target() }; // type doesn't really matter
+    if (!target.hasFlag(.user1)) { // .user1 is set in modal setup
+        return;
     }
+
+    const idx_any = target.userdata() orelse return;
+    const btn_index: usize = @intFromPtr(idx_any) - 1;
+
+    const win = lvgl.Window{ .lvobj = @ptrCast(edata) };
+    const ctx_any = win.userdata() orelse return;
+    const ctx: *ModalCtx = @ptrCast(@alignCast(ctx_any));
+    const cb = ctx.cb;
+
+    // Destroying the window triggers LV_EVENT_DELETE, which frees ctx.
+    win.destroy();
+
+    cb(btn_index);
 }