[Bug] NullPointerException crash in FastMpayScreen due to unsafe access on mutable Compose state

[ayuxsh009]

Description

The FastMpayScreen contains unsafe non-null assertions (!!) on nullable mutable Compose state variables inside conditional null checks.

Because these states are declared as mutable var Compose states, recomposition may occur between the null check and the !! dereference, causing the value to become null and resulting in a NullPointerException.

Location

feature/fast-mpay/src/commonMain/kotlin/org/mifospay/feature/fastmpay/FastMpayScreen.kt

Bank mismatch sheet

if (showBankMismatchSheet && bankMismatchData != null) {
    val mismatchData = bankMismatchData!! // unsafe
}

Amount confirmation sheet

if (showAmountConfirmation && pendingAmountConfirmation != null) {
    val pending = pendingAmountConfirmation!! // unsafe
}

Root Cause

bankMismatchData and pendingAmountConfirmation are mutable Compose states (var).

In Jetpack Compose, recomposition can happen between:

1. the null check (state != null)
2. the !! dereference

This creates a race condition where the value becomes null after the check but before dereferencing.

Steps to Reproduce

1. Open FastMpay screen
2. Scan a QR code from another bank (opens bank mismatch sheet)
3. Trigger rapid recomposition/interactions while the sheet is rendering
4. App crashes with NullPointerException

Same issue can occur for the amount confirmation sheet.

Expected Behavior

The sheet should render safely or be skipped gracefully if the state becomes null.

Actual Behavior

Application crashes with NullPointerException.

Impact

• Affects all Compose targets:

  • Android
  • Desktop
  • Web

[JonnyLewis]

Fixed in a16c0bf (branch feature/notifications-push-android-parity, flows to development via PR).

Both sheets now snapshot the mutable Compose state into a local val before the null check, so the smart-cast local is stable across recomposition — no !! remains anywhere in FastMpayScreen.kt. The bank-mismatch block's mixed mismatchData?./asserted access was cleaned up in the same pass.

Verified: :feature:fast-mpay:compileKotlinDesktop green; full desktop/Android/iOS-simulator matrix compiled. (The module's desktopTest suite has a pre-existing, unrelated test-fake compile error — FakeUserPreferencesRepository missing interface members — which predates this change.)

[JonnyLewis]

This is fixed in the SimpliPay fork (JonnyLewis/simplipay-mobile-wallet@a16c0bf7) and the patch upstreams cleanly.

Root cause as described: bankMismatchData / pendingAmountConfirmation are mutable Compose states, so recomposition between the null check and the !! dereference can NPE. Fix: snapshot each state into a local val before the null check so the smart-cast local is stable for the whole block — no !! remains in FastMpayScreen.kt. Verified compiling across desktop/Android/iOS targets. Happy to raise a PR here if useful.