When removing the last TpDBusDaemon from a DBusConnection, forcibly free the GSList ** too

You might think (and indeed I did) that
dbus_connection_free_data_slot (&daemons_slot) would automatically clear
out that slot on every DBusConnection, calling the registered
free-function for the old contents.

This is, as it turns out, untrue; you have to do that yourself, first.

This turns out to crash git master (the MC 4 branch) of Empathy during
startup: it briefly creates a TpDBusDaemon, then deallocates it again.
The GSList ** is placed in slot 2 on the DBusConnection. We then
deallocate slot 2. When dbus-glib allocates a new slot number for its
DBusGProxyManager objects, it is also told to use slot 2; it looks in
slot 2, finds our GSList ** still there, interprets it as a
DBusGProxyManager *, and crashes with an assertion failure.

Reviewed-by: Will Thompson <will.thompson@collabora.co.uk>

1 files changed, 7 insertions, 0 deletions

diff --git a/telepathy-glib/dbus-daemon.c b/telepathy-glib/dbus-daemon.c
index 8028d93a3..2e6a324c6 100644
--- a/telepathy-glib/dbus-daemon.c
+++ b/telepathy-glib/dbus-daemon.c
@@ -1300,6 +1300,13 @@ tp_dbus_daemon_dispose (GObject *object)
       if (G_LIKELY (daemons != NULL))
         {
           *daemons = g_slist_remove (*daemons, self);
+
+          if (*daemons == NULL)
+            {
+              /* this results in a call to free_daemon_list (daemons) */
+              dbus_connection_set_data (self->priv->libdbus, daemons_slot,
+                  NULL, NULL);
+            }
         }
 
       dbus_connection_unref (self->priv->libdbus);