diff --git a/ChangeLog b/ChangeLog
index a8eff6a..f8a2d89 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,9 @@
-2017-12-21 master
+2017-12-29 master
 - Fixes:
+  - Fixed several use-after-free errors in the timer code
   - Merged patches and fixed other warnings on OpenBSD
+  - Task, Button, Executor: add a bit of slack in the pango text layout,
+    to avoid wrapping due to rounding errors
 
 2017-12-20 16.0
 - Fixes:
diff --git a/src/battery/battery.c b/src/battery/battery.c
index 0d19443..d6e438a 100644
--- a/src/battery/battery.c
+++ b/src/battery/battery.c
@@ -127,7 +127,7 @@ void cleanup_battery()
     ac_connected_cmd = NULL;
     free(ac_disconnected_cmd);
     ac_disconnected_cmd = NULL;
-    stop_timer(&battery_timeout);
+    destroy_timer(&battery_timeout);
     battery_found = FALSE;
 
     battery_os_free();
diff --git a/src/clock/clock.c b/src/clock/clock.c
index fca4c30..abbd8ad 100644
--- a/src/clock/clock.c
+++ b/src/clock/clock.c
@@ -65,6 +65,7 @@ void default_clock()
     time1_timezone = NULL;
     time2_format = NULL;
     time2_timezone = NULL;
+    INIT_TIMER(clock_timeout);
     time_tooltip_format = NULL;
     time_tooltip_timezone = NULL;
     clock_lclick_command = NULL;
@@ -109,7 +110,7 @@ void cleanup_clock()
     clock_uwheel_command = NULL;
     free(clock_dwheel_command);
     clock_dwheel_command = NULL;
-    stop_timer(&clock_timeout);
+    destroy_timer(&clock_timeout);
 }
 
 struct tm *clock_gettime_for_tz(const char *timezone)
diff --git a/src/execplugin/execplugin.c b/src/execplugin/execplugin.c
index 4df235f..2e539be 100644
--- a/src/execplugin/execplugin.c
+++ b/src/execplugin/execplugin.c
@@ -41,6 +41,7 @@ Execp *create_execp()
     execp->backend->cache_icon = TRUE;
     execp->backend->centered = TRUE;
     execp->backend->font_color.alpha = 0.5;
+    INIT_TIMER(execp->backend->timer);
     return execp;
 }
 
@@ -67,7 +68,7 @@ void destroy_execp(void *obj)
         free_and_null(execp);
     } else {
         // This is a backend element
-        stop_timer(&execp->backend->timer);
+        destroy_timer(&execp->backend->timer);
 
         free_icon(execp->backend->icon);
         free_and_null(execp->backend->buf_stdout);
diff --git a/src/init.c b/src/init.c
index 001b551..2252fa9 100644
--- a/src/init.c
+++ b/src/init.c
@@ -144,7 +144,7 @@ void start_detect_compositor()
 
     // Check every 0.5 seconds for up to 30 seconds
     detect_compositor_timer_counter = 60;
-    init_timer(&detect_compositor_timer, "detect_compositor_timer");
+    INIT_TIMER(detect_compositor_timer);
     change_timer(&detect_compositor_timer, true, 500, 500, detect_compositor, 0);
 }
 
diff --git a/src/panel.c b/src/panel.c
index 4deafb4..e5bc289 100644
--- a/src/panel.c
+++ b/src/panel.c
@@ -145,7 +145,7 @@ void cleanup_panel()
         if (p->main_win)
             XDestroyWindow(server.display, p->main_win);
         p->main_win = 0;
-        stop_timer(&p->autohide_timeout);
+        destroy_timer(&p->autohide_timeout);
         cleanup_freespace(p);
     }
 
@@ -207,6 +207,7 @@ void init_panel()
     panels = calloc(num_panels, sizeof(Panel));
     for (int i = 0; i < num_panels; i++) {
         memcpy(&panels[i], &panel_config, sizeof(Panel));
+        INIT_TIMER(panels[i].autohide_timeout);
     }
 
     fprintf(stderr,
diff --git a/src/systray/systraybar.c b/src/systray/systraybar.c
index 2f0b4e0..c6da42b 100644
--- a/src/systray/systraybar.c
+++ b/src/systray/systraybar.c
@@ -730,6 +730,8 @@ gboolean add_icon(Window win)
     traywin->pid = pid;
     traywin->name = name;
     traywin->chrono = chrono;
+    INIT_TIMER(traywin->render_timeout);
+    INIT_TIMER(traywin->resize_timeout);
     chrono++;
 
     show(&systray.area);
@@ -940,8 +942,8 @@ void remove_icon(TrayWindow *traywin)
     XDestroyWindow(server.display, traywin->parent);
     XSync(server.display, False);
     XSetErrorHandler(old);
-    stop_timer(&traywin->render_timeout);
-    stop_timer(&traywin->resize_timeout);
+    destroy_timer(&traywin->render_timeout);
+    destroy_timer(&traywin->resize_timeout);
     free(traywin->name);
     if (traywin->image) {
         imlib_context_set_image(traywin->image);
diff --git a/src/tooltip/tooltip.c b/src/tooltip/tooltip.c
index 1b60010..affb0f1 100644
--- a/src/tooltip/tooltip.c
+++ b/src/tooltip/tooltip.c
@@ -44,6 +44,9 @@ void default_tooltip()
     // give the tooltip some reasonable default values
     memset(&g_tooltip, 0, sizeof(Tooltip));
 
+    INIT_TIMER(g_tooltip.timeout);
+    INIT_TIMER(g_tooltip.update_timeout);
+
     g_tooltip.font_color.rgb[0] = 1;
     g_tooltip.font_color.rgb[1] = 1;
     g_tooltip.font_color.rgb[2] = 1;
@@ -54,7 +57,8 @@ void default_tooltip()
 void cleanup_tooltip()
 {
     stop_tooltip_timeout();
-    stop_timer(&g_tooltip.update_timeout);
+    destroy_timer(&g_tooltip.timeout);
+    destroy_timer(&g_tooltip.update_timeout);
     tooltip_hide(NULL);
     tooltip_update_contents_for(NULL);
     if (g_tooltip.window)