crash in dbus_g_proxy_cancel_call when destroying DBusGProxy

[maxprofitisback]

Hi,

My dbus-glib application is crashing when it unref/destroys a
DBusGProxy. Crash happens around the function dbus_g_proxy_cancel_call
(dbus-gproxy.c), because g_hash_table_remove (dbus_pending_call_unref)
and dbus_pending_call_cancel will call twice
_dbus_pending_call_last_unref (dbus-pending-call.c) in DBus and also
crash at "dbus_free (pending);"

In dbus_g_proxy_cancel_call function, I don't understand why when the
refcount of a DBusPendingCall is 1 and DBusPendingCall is correctly
destroyed through g_hash_table_remove, the same DBusPendingCall has to
continue go through dbus_pending_call_cancel.

Can someone explain me ?

Thanks!