Skip to content

Conversation

@lzwind
Copy link

@lzwind lzwind commented Nov 26, 2025

The previous code used 'delete this' in a service watcher callback, causing use-after-free when D-Bus clients disconnect unexpectedly.

Reproduction:

  1. Start fcitx5 and IBus application (gedit)
  2. Force kill: kill -9 $(pgrep gedit)
  3. fcitx5 may crash due to use-after-free

The previous code used 'delete this' in a service watcher callback,
causing use-after-free when D-Bus clients disconnect unexpectedly.
@wengxt
Copy link
Member

wengxt commented Nov 26, 2025

I don't think it should happen, what's the version of fcitx you're using?

@lzwind
Copy link
Author

lzwind commented Nov 27, 2025

The version I'm using is 5.1.16. This issue reproduces frequently in our environment when IBus applications crash unexpectedly. After applying the eventDispatcher().schedule() fix, the problem has been resolved - no more crashes observed in our testing.

The race condition is confirmed by the code comment in servicewatcher.cpp: "this maybe deleted as well because it's a member in lambda."

@wengxt
Copy link
Member

wengxt commented Nov 27, 2025

the bug is on line 48, not really here

@wengxt wengxt closed this in df31685 Nov 27, 2025
@lzwind
Copy link
Author

lzwind commented Nov 27, 2025

The ServiceWatcher fix only addresses the serviceOwnerAsync callback, but the NameOwnerChanged signal handler still directly calls entry() without any protection. This path can still trigger immediate 'delete this' in frontend callbacks, causing use-after-free conditions. The eventDispatcher().schedule() approach provides comprehensive protection for all callback paths.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants