[Spice-devel] [PATCH spice-server] red-qxl: Retain RCC pointer in migration request

[Frediano Ziglio]

The message is asynchronous so to avoid the object to potentially
been released before being processed keep a strong reference to
it.

Signed-off-by: Frediano Ziglio <fziglio at redhat.com>
---
 server/red-qxl.c    | 4 ++--
 server/red-worker.c | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/server/red-qxl.c b/server/red-qxl.c
index e145ea49..6ad8f6a5 100644
--- a/server/red-qxl.c
+++ b/server/red-qxl.c
@@ -130,7 +130,7 @@ static void red_qxl_display_migrate(RedChannelClient *rcc)
     g_object_get(channel, "channel-type", &type, "id", &id, NULL);
     dispatcher = (Dispatcher *)g_object_get_data(G_OBJECT(channel), "dispatcher");
     spice_printerr("channel type %u id %u", type, id);
-    payload.rcc = rcc;
+    payload.rcc = g_object_ref(rcc);
     dispatcher_send_message(dispatcher,
                             RED_WORKER_MESSAGE_DISPLAY_MIGRATE,
                             &payload);
@@ -187,7 +187,7 @@ static void red_qxl_cursor_migrate(RedChannelClient *rcc)
     g_object_get(channel, "channel-type", &type, "id", &id, NULL);
     dispatcher = (Dispatcher *)g_object_get_data(G_OBJECT(channel), "dispatcher");
     spice_printerr("channel type %u id %u", type, id);
-    payload.rcc = rcc;
+    payload.rcc = g_object_ref(rcc);
     dispatcher_send_message(dispatcher,
                             RED_WORKER_MESSAGE_CURSOR_MIGRATE,
                             &payload);
diff --git a/server/red-worker.c b/server/red-worker.c
index 0e2e8fa3..7cb4fc49 100644
--- a/server/red-worker.c
+++ b/server/red-worker.c
@@ -762,6 +762,7 @@ static void handle_dev_display_migrate(void *opaque, void *payload)
     spice_debug("migrate display client");
     spice_assert(rcc);
     red_migrate_display(worker->display_channel, rcc);
+    g_object_unref(rcc);
 }
 
 static inline uint32_t qxl_monitors_config_size(uint32_t heads)
@@ -843,6 +844,7 @@ static void handle_dev_cursor_migrate(void *opaque, void *payload)
 
     spice_debug("migrate cursor client");
     cursor_channel_client_migrate(rcc);
+    g_object_unref(rcc);
 }
 
 static void handle_dev_set_compression(void *opaque, void *payload)
-- 
2.13.5