Dear Maintainer,

Sway crashes reproducibly with fractional scaling (e.g. scale 1.25 or
1.75) due to an assertion failure in wlr_render_pass_add_texture:

  sway: render/pass.c:23: wlr_render_pass_add_texture: Assertion
  `box->x >= 0 && box->y >= 0 &&
   box->x + box->width <= options->texture->width &&
   box->y + box->height <= options->texture->height' failed.

The crash is triggered under moderate load with fractional scaling
active. Setting scale to 1.0 prevents it. This is the same root cause
as closed bug #1115160, which was fixed in wlroots 0.19.1-1 (unstable)
by casting floating-point sums to uint32_t before comparing against
integer texture dimensions.

The fix backports cleanly to 0.18.2. Patch:
--- a/render/pass.c
+++ b/render/pass.c
@@ -21,8 +21,8 @@
      if (!wlr_fbox_empty(&options->src_box)) {
              const struct wlr_fbox *box = &options->src_box;
              assert(box->x >= 0 && box->y >= 0 &&
-                     box->x + box->width <= options->texture->width &&
-                     box->y + box->height <= options->texture->height);
+                     (uint32_t)(box->x + box->width) <= options->texture->width &&
+                     (uint32_t)(box->y + box->height) <= options->texture->height);
      }

I built and installed libwlroots-0.18_0.18.2-3+patch1 locally and the
crash has not recurred. Please consider including this fix in a trixie
point update.

System: ThinkPad X1 Carbon 7th gen, Sway 1.10.1-2, eDP-1 at scale 1.25.

Hi,

I'm hitting the same crash and can confirm that the patch from the original
report fixes it. I've attached a debdiff against 0.18.2-3 for trixie that
adds the upstream patch, in case it saves time.

System: Chuwi MiniBook X (Intel N100), Debian 13, sway 1.10.1,
libwlroots-0.18 0.18.2-3, eDP-1 at scale 1.25.

For me the trigger was scrolling in a telegram chat inside Google Chrome,
it would crash my entire sway session.

From the generated core dump gdb shows:

```
(gdb) p options->src_box
$1 = {x = 1.2523364485981308, y = 0, width = 266.7476635514019, height =
31.73076923076923}
(gdb) p options->texture->width
$2 = 268
(gdb) p options->texture->height
$3 = 33
```

Which causes this part of the assertion to fail:

```
box->x + box->width <= options->texture->width
```

Testing: I've built for Trixie using dpkg-buildpackage, ran it against a
reproducer that uses the values above (it aborts on the old version; I can
share if needed), as well as using it for a few days. My Telegram chat
crashes immediately if I revert the change.

Is a Trixie update planned for this? Happy to test whatever is needed.

Thanks!!
Marco