sn-item: cancel in-flight async calls on dispose to fix SIGSEGV

[leigh123linux]

The crash occurs when a remote D-Bus peer disconnects while an async
g_dbus_proxy_call() for GetAll properties is still in flight. When the
callback fires it calls g_dbus_proxy_get_name(item->sn_item_proxy) in the
error path, but sn_item_proxy may have been cleared by sn_item_dispose(),
leaving a dangling pointer (observed value 0x4e7375746174532f = "/StatusN").

Cancel the GCancellable in sn_item_dispose() before clearing the proxy
objects so that any in-flight or queued async callbacks receive a
cancellation error and return early via the existing G_IO_ERROR_CANCELLED
check, without touching freed state.

A NULL guard on item->prop_proxy and item->sn_item_proxy is added in the
success path of get_all_properties_callback() as a belt-and-suspenders
check against any future code path that clears the proxy without going
through dispose().

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2477415
https://bugzilla.redhat.com/show_bug.cgi?id=2428140

[Copilot]

Pull request overview

This PR addresses a SIGSEGV in the status notifier item watcher by ensuring in-flight async D-Bus calls are cancelled during object disposal, preventing callbacks from touching cleared proxy state.

Changes:

• Cancel GCancellable in sn_item_dispose() before clearing proxies to abort in-flight/queued async operations safely.
• Add a NULL-guard in get_all_properties_callback() to bail out if proxies were cleared before processing results.

Comments suppressed due to low confidence (1)

xapp-sn-watcher/sn-item.c:181

• Now that dispose() actively cancels item->cancellable, any pending async ops (e.g. the g_dbus_proxy_new() in initialize_item()) will complete with G_IO_ERROR_CANCELLED. In property_proxy_acquired(), the CANCELLED branch currently does not g_error_free(error) and does not return, so it will continue initializing the item with prop_proxy == NULL. Please make the CANCELLED path free the error and return early to avoid leaks and inconsistent state.

    g_cancellable_cancel (item->cancellable);

    g_clear_pointer (&item->sortable_name, g_free);
    g_clear_object (&item->status_icon);
    g_clear_object (&item->prop_proxy);
    g_clear_object (&item->sn_item_proxy);
    g_clear_object (&item->cancellable);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[leigh123linux]

That was your suggestion, are you an idiot?

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

xapp-sn-watcher/sn-item.c:1178

• With the new dispose-time g_cancellable_cancel(), g_dbus_proxy_new_finish() can now fail with G_IO_ERROR_CANCELLED. In that case this callback currently neither frees error nor returns, and it proceeds with item->prop_proxy == NULL to connect signals/create the status icon/queue updates, which can lead to crashes or inconsistent state. Handle the cancelled case explicitly by freeing error and returning early (and ensure the SnItem ref is released in the same cleanup path).

    item->prop_proxy = g_dbus_proxy_new_finish (res, &error);

    if (error != NULL)
    {
        if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
        {
            g_critical ("Could not get property proxy for %s: %s\n",
                        g_dbus_proxy_get_name (item->sn_item_proxy),
                        error->message);
            g_error_free (error);
            return;
        }
    }

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.