GVariant: Fix memory leak when boxing and unboxing variants

Fixes bug 674201.

2 files changed, 10 insertions, 1 deletions

diff --git a/codegen/valaccodebasemodule.vala b/codegen/valaccodebasemodule.vala
index 55af6c51e..13a144696 100644
--- a/codegen/valaccodebasemodule.vala
+++ b/codegen/valaccodebasemodule.vala
@@ -5285,7 +5285,7 @@ public abstract class Vala.CCodeBaseModule : CodeGenerator {
 		                        && type.data_type != gvariant_type);
 
 		if (type.value_owned
-		    && (target_type == null || !target_type.value_owned || boxing || unboxing)
+		    && (target_type == null || !target_type.value_owned || boxing || unboxing || gvariant_boxing)
 		    && !gvalue_boxing /* gvalue can assume ownership of value, no need to free it */) {
 			// value leaked, destroy it
 			if (target_type is PointerType) {
diff --git a/vala/valacastexpression.vala b/vala/valacastexpression.vala
index 40ed1ce3f..c7a72b6f2 100644
--- a/vala/valacastexpression.vala
+++ b/vala/valacastexpression.vala
@@ -152,11 +152,20 @@ public class Vala.CastExpression : Expression {
 			value_type.nullable = true;
 		}
 
+		if (is_gvariant (context, inner.value_type) && !is_gvariant (context, value_type)) {
+			// GVariant unboxing returns owned value
+			value_type.value_owned = true;
+		}
+
 		inner.target_type = inner.value_type.copy ();
 
 		return !error;
 	}
 
+	bool is_gvariant (CodeContext context, DataType type) {
+		return type.data_type != null && type.data_type.is_subtype_of (context.analyzer.gvariant_type.data_type);
+	}
+
 	public override void emit (CodeGenerator codegen) {
 		inner.emit (codegen);