Merge lp:~mterry/libdbusmenu/749609 into lp:libdbusmenu/0.5

[Michael Terry]

When looking at bug 749609, I realized that what was happening was that the menuproxy object was living longer than the client object. So it's callbacks were still happening and trying to access dead client object memory.

So one thing I did to reduce bug surface area was to disconnect all signals with the client object as callback data (there are three such callbacks in client.c).

Secondly, I looked at why the menuproxy might be surviving longer than the client. While async calls are ongoing, the menuproxy has an additional ref, and I started looking there. Most of the async calls ref the client object for the lifetime of the call to avoid this problem, but one async call didn't (the "Event" call), so I added a ref there.

[lp:~mterry/libdbusmenu/749609]

289. By Michael Terry on 2011-04-05

fix typo

=== modified file 'libdbusmenu-glib/client.c'
--- libdbusmenu-glib/client.c	2011-03-29 02:24:01 +0000
+++ libdbusmenu-glib/client.c	2011-04-05 16:15:26 +0000
@@ -441,6 +441,9 @@
 		priv->menuproxy_cancel = NULL;
 	}
 	if (priv->menuproxy != NULL) {
+		g_signal_handlers_disconnect_matched(priv->menuproxy,
+		                                     G_SIGNAL_MATCH_DATA,
+		                                     0, 0, NULL, NULL, object);
 		g_object_unref(G_OBJECT(priv->menuproxy));
 		priv->menuproxy = NULL;
 	}
@@ -1494,6 +1497,7 @@
 	g_variant_unref(edata->variant);
 	g_free(edata->event);
 	g_object_unref(edata->menuitem);
+	g_object_unref(edata->client);
 	g_free(edata);
 
 	if (G_UNLIKELY(error != NULL)) {
@@ -1528,6 +1532,7 @@
 
 	event_data_t * edata = g_new0(event_data_t, 1);
 	edata->client = client;
+	g_object_ref(client);
 	edata->menuitem = mi;
 	g_object_ref(edata->menuitem);
 	edata->event = g_strdup(name);