I met a strange problem: after dispose g_object_ref could also succeed!

[Peter Cai <newptcai gmail com>]

I met a strange problem: after dispose ( or during dispose) g_object_ref could also succeed!  http://pastebin.com/d631246a7

It crashes on line 24, which is almost impossible.  

1st, I checked these variables.
2nd, I called g_object_ref(self) to avoid self being disposed while this function has not returned. 

The only explanation is that : after dispose is called but before finalize is called, g_object_ref still could succeed!

Is that true?

1. static gboolean vivs_net_inspiration_on_recv(GIOChannel *source, GIOCondition condition, gpointer data)
2. {
3.     VivsNetInspiration* self = VIVS_NET_INSPIRATION(data);
4.  
5.     if(!g_object_ref(self))
6.         return FALSE;
7.    
8.     g_mutex_lock(self->priv->lock);
9.  
10.     gsize   length = 0;
11.     GError* err = NULL;
12.  
13.     if(self->priv->channel && self->priv->composition)
14.     {
15.         GIOStatus status =  g_io_channel_read_chars(self->priv->channel,
16.                     self->priv->pkt_buffer, MAX_PKT_LEN, &length, &err);
17.         if(G_IO_STATUS_NORMAL == status)
18.         {
19.             // ???????????   the following line crash because self->priv->composition is NULL
20.             // at this moment, which is almost impossible.
21.             // composition could only be null after dispose, but I have called g_object_ref(self)
22.              // How can this happen!!
23.  
24.             vivs_icomposition_write(self->priv->composition, self->priv->pkt_buffer, length);
25.         }
26.         else if(G_IO_STATUS_AGAIN != status)
27.         {
28.             g_assert(err != NULL);
29.             g_error_free(err);
30.         }
31.     }
32.  
33. on_return:
34.     g_mutex_unlock(self->priv->lock);
35.  
36.     g_object_unref(self);
37.     return TRUE;
38. }

-- 
look to the things around you,the immediate world around you, if you are alive,it will mean something to you ——Paul Strand