cinnamon-session aborts on g_variant_unref(NULL) when an Electron client (Obsidian) crashes mid-DBus dispatch — kicks user to LightDM greeter

[Louranicas]

Body (paste into "Add a description")

Summary

When an Electron-based DBus client (Obsidian 1.12.7, bundled Chromium) crashes
with an int3 trap inside dbus_connection_dispatch, cinnamon-session-binary
itself aborts on g_variant_unref: assertion 'value != NULL' failed and the
entire user session is torn down — LightDM returns to the greeter and every
X-session child process (terminals, multiplexers, editors, IDEs) is killed.

The session manager should log the misbehaving client and continue, not abort.

Reproduced 4 times in 1 hour on 2026-05-10 (13:05, 13:08, 13:24, 13:57)
plus once on 2026-05-08 with the identical signature.

Environment

Distro	Linux Mint 22.2 (Zara)
Session	X11 / X-Cinnamon
cinnamon-session	6.4.0+xia
cinnamon	6.4.8+xia
Display manager	LightDM
Kernel	6.8.0-110-generic
GPU	AMD Radeon RX 7900 XT (amdgpu)
Triggering app	Obsidian 1.12.7 (Electron / Chromium)

Crash signature (journalctl, one occurrence)

May 10 13:57:38 kernel: traps: ThreadPoolSingl[1497465] trap int3 ip:5af2bf41433e
sp:7c4423df8440 error:0 in obsidian[5af2badd7000+923e000]
May 10 13:57:38 cinnamon-session-binary: CRITICAL: Unable to start session:
Lost name on bus: org.gnome.SessionManager
May 10 13:57:38 cinnamon-session-binary: GLib-CRITICAL: g_variant_unref:
assertion 'value != NULL' failed
May 10 13:57:38 cinnamon-session-binary: CRITICAL: Unable to close Cinnamon's
end session dialog: The connection is closed
May 10 13:57:38 cinnamon-session-binary: GLib-GObject-CRITICAL: g_object_unref:
assertion 'G_IS_OBJECT (object)' failed
May 10 13:57:38 lightdm: pam_unix(lightdm:session): session closed for user
May 10 13:57:38 systemd-logind: Session c8 logged out. Waiting for processes to exit.
May 10 13:57:39 systemd-coredump: Process 1497452 (obsidian) of user 1000 dumped core.
May 10 13:57:39 lightdm: pam_unix(lightdm-greeter:session): session opened for user lightdm
May 10 13:57:39 systemd-logind: New session c9 of user lightdm.

The Obsidian coredump confirms the crashing thread was inside DBus dispatch
when it hit the int3:

Stack trace of thread 1497465 (ThreadPoolSingl):
#0..#3 (obsidian internal)
#4 dbus_connection_dispatch (libdbus-1.so.3 + 0x181b9)
#5..#13 (obsidian internal)
#14 start_thread (libc.so.6 + 0x9caa4)

Expected behaviour

A single misbehaving DBus client crashing should not be able to take down
cinnamon-session and end the user session. The g_variant_unref(NULL) is a
defensive bug inside cinnamon-session: somewhere in the
Lost name on bus / end-session-dialog cleanup path, a GVariant* is unref'd
without a null check after the client connection is already closed.

Actual behaviour

cinnamon-session aborts → systemd-logind closes the session → LightDM greeter →
all running work in the X session is lost (terminal multiplexers, editors,
running builds, unsaved buffers).

Reproduction

The triggering Obsidian/Chromium crash itself is rare and not deterministic.
However, the cinnamon-session vulnerability should be reproducible synthetically
by killing any DBus-registered session client uncleanly mid-method-call —
for example kill -SEGV <pid> of a session-registered client during an
EndSessionResponse exchange, or while the session manager is processing
org.gnome.SessionManager name loss.

Suggested fix

Audit the Lost name on bus / end-session-dialog cleanup paths in
cinnamon-session for unchecked g_variant_* and g_object_* calls. Add
g_return_if_fail (value != NULL) guards. Treat connection is closed as a
recoverable warning, not a fatal session-ending event.

Relevant search points (likely candidates):

• whatever handles the name-lost signal on org.gnome.SessionManager
• the dialog-close path that emits Unable to close Cinnamon's end session dialog

Workaround currently applied locally (not a fix)

Launch Obsidian with --disable-gpu --disable-gpu-compositing --disable-software-rasterizer. This eliminates the Chromium GPU-process path
that trips the int3 — i.e. it removes the trigger but does not address the
cinnamon-session fragility. Any other Electron app crashing mid-DBus will
reproduce the same kickout.

---