Comment 5 for bug 752959

This one is confusing. If I had to guess, it's only priv->dbusobject that is bogus (value of 0x2), as other priv values are used and set before the line that crashes. The callback hasn't been cancelled. And dbusobject is only set in one place, which seems pretty innocuous. It's actually never even freed (it's leaked when the server object is finalized). So I really doubt the crash is because of the server object dying but this callback somehow being called.

Maybe... Maybe the server got passed some bogus memory for the dbusobject name. I'll look into that, but based on the trace alone, this is a hard one.