codegen: Keep arrays alive during async server method calls

When calling a co-routine it is the caller's responsibility to ensure
that arrays stay alive for the duration of the call. The GDBus server
code emitted did not do this, resulting in use-after-free.

https://bugzilla.gnome.org/show_bug.cgi?id=783002

2 files changed, 71 insertions, 0 deletions

diff --git a/tests/Makefile.am b/tests/Makefile.am
index 0645f2f13..5a7dbebee 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -375,6 +375,7 @@ TESTS = \
 	dbus/bug596862.vala \
 	dbus/bug602003.test \
 	dbus/bug782719.test \
+	dbus/bug783002.test \
 	dbus/bug792277.vala \
 	dbus/rawvariants.test \
 	gir/bug651773.test \
diff --git a/tests/dbus/bug783002.test b/tests/dbus/bug783002.test
new file mode 100644
index 000000000..f300c2beb
--- /dev/null
+++ b/tests/dbus/bug783002.test
@@ -0,0 +1,70 @@
+Packages: gio-2.0
+D-Bus
+
+Program: client
+
+[DBus (name = "org.example.Test")]
+interface Test : Object {
+	public abstract async string test_array_lifetime (string[] items) throws IOError;
+}
+
+MainLoop main_loop;
+
+void main () {
+	main_loop = new MainLoop ();
+	run.begin ();
+	main_loop.run ();
+}
+
+async void run () {
+	Test test = yield Bus.get_proxy (BusType.SESSION, "org.example.Test", "/org/example/test");
+
+	var result = yield test.test_array_lifetime (new string[] { "Badger", "Snake", "Mushroom" });
+	assert (result == "BadgerSnakeMushroom");
+
+	main_loop.quit ();
+}
+
+Program: server
+
+[DBus (name = "org.example.Test")]
+class Test : Object {
+	public async string test_array_lifetime (string[] items) throws IOError {
+		Idle.add (() => {
+			test_array_lifetime.callback ();
+			return false;
+		});
+		yield;
+
+		var result = new StringBuilder ();
+		foreach (var item in items) {
+			result.append (item);
+		}
+
+		assert (result.str == "BadgerSnakeMushroom");
+		return result.str;
+	}
+}
+
+MainLoop main_loop;
+
+void on_client_exit (Pid pid, int status) {
+	assert (status == 0);
+	main_loop.quit ();
+}
+
+void main () {
+	var conn = Bus.get_sync (BusType.SESSION);
+	conn.register_object ("/org/example/test", new Test ());
+
+	var request_result = conn.call_sync ("org.freedesktop.DBus", "/org/freedesktop/DBus", "org.freedesktop.DBus", "RequestName",
+	                                      new Variant ("(su)", "org.example.Test", 0x4), null, 0, -1);
+	assert ((uint) request_result.get_child_value (0) == 1);
+
+	Pid client_pid;
+	Process.spawn_async (null, { "test", "/dbus/bug783002/client" }, null, SpawnFlags.DO_NOT_REAP_CHILD, null, out client_pid);
+	ChildWatch.add (client_pid, on_client_exit);
+
+	main_loop = new MainLoop ();
+	main_loop.run ();
+}