suggestion-model: fix crash when typing in address barmcatanzaro/#1522

We have a refcounting error in ephy_suggestion_model_query_async(),
where we pass our task into query_collections_done() without reffing it.
Then the task is already destroyed when we go to form the history query,
and it has destroyed our QueryData with it, and so we have a UI process
crash when attempting to g_strsplit (data->query).

There's no need for each outstanding query to ref the task. Let's just
use one ref and drop it when the final query completes.

Fixes #1522

1 files changed, 5 insertions, 7 deletions

diff --git a/src/ephy-suggestion-model.c b/src/ephy-suggestion-model.c
index 74976fc99..101dcb7d4 100644
--- a/src/ephy-suggestion-model.c
+++ b/src/ephy-suggestion-model.c
@@ -405,7 +405,7 @@ query_data_free (QueryData *data)
   g_clear_pointer (&data->bookmarks, g_sequence_free);
   g_clear_pointer (&data->history, g_sequence_free);
   g_clear_pointer (&data->google_suggestions, g_sequence_free);
-  g_free (data->query);
+  g_clear_pointer (&data->query, g_free);
   g_free (data);
 }
 
@@ -420,10 +420,8 @@ query_collection_done (EphySuggestionModel *self,
   self = g_task_get_source_object (task);
   data = g_task_get_task_data (task);
 
-  if (--data->active_sources) {
-    g_object_unref (task);
+  if (--data->active_sources)
     return;
-  }
 
   g_cancellable_cancel (self->icon_cancellable);
   g_clear_object (&self->icon_cancellable);
@@ -766,7 +764,7 @@ ephy_suggestion_model_query_async (EphySuggestionModel *self,
   /* Google Search Suggestions */
   if (data->scope == QUERY_SCOPE_ALL || data->scope == QUERY_SCOPE_SUGGESTIONS) {
     if (g_settings_get_boolean (EPHY_SETTINGS_MAIN, EPHY_PREFS_USE_GOOGLE_SEARCH_SUGGESTIONS))
-      google_search_suggestions_query (self, query, g_object_ref (task));
+      google_search_suggestions_query (self, query, task);
     else
       query_collection_done (self, task);
   }
@@ -791,10 +789,10 @@ ephy_suggestion_model_query_async (EphySuggestionModel *self,
   }
 
   if (data->scope == QUERY_SCOPE_ALL || data->scope == QUERY_SCOPE_TABS)
-    tabs_query (self, data, g_object_ref (task));
+    tabs_query (self, data, task);
 
   if (data->scope == QUERY_SCOPE_ALL || data->scope == QUERY_SCOPE_BOOKMARKS)
-    bookmarks_query (self, data, g_object_ref (task));
+    bookmarks_query (self, data, task);
 }
 
 gboolean