free-memory-read crash in indicator-sound-service's file monitoring

[Charles Kerr]

Okay, this is a fun one.

Found while investigating lp bug #949837 ... the closure in establish_file_monitoring() has some interesting behavior. The lambda function's variable "monitor" is bound to the lifespan of the "changed" signal that owns it, meaning that destroying the FileMonitor unconnects that signal which in turn tickles some valac-generated code that tries to kill "monitor" again.

The workaround has two parts:

1. Create a local *unowned* copy of "monitor" for use in the closure. This prevents the closure from holding onto a reference, solving the problem of it trying to free the monitor whenever it gets freed.

2. Since the first step removed our closure's reference to FileMonitor, the monitor is freed at the end of establish_file_monitoring() s.t. no monitoring is established. ;) Manually add a refcount to prevent this... this ref is balanced out by the unref in relevant_desktop_file_changed().