[glib] g_dbus_connection_export_menu_model(): fix a crash

[Ryan Lortie <ryanl src gnome org>]

commit f20ae7fcfdaf9adeac3f73242adb798f1a80ddff
Author: Ryan Lortie <desrt desrt ca>
Date:   Mon Oct 29 09:09:49 2012 +0100

    g_dbus_connection_export_menu_model(): fix a crash
    
    Add some extra protection when 'preparing' a group that doesn't yet
    contain any menus.  This can happen if you subscribe to a group that
    doesn't yet exist.
    
    It was possible to crash any application using
    g_dbus_connection_export_menu_model() by requesting a non-existent
    subscription group over the bus.
    
    In practice this only happened in races -- where the proxy sees a group
    that exists and queries it, but by the time it does, it's already gone.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=687089

 gio/gmenuexporter.c |   11 ++++++++++-
 1 files changed, 10 insertions(+), 1 deletions(-)
---
diff --git a/gio/gmenuexporter.c b/gio/gmenuexporter.c
index 8509ffd..d9db6cc 100644
--- a/gio/gmenuexporter.c
+++ b/gio/gmenuexporter.c
@@ -357,7 +357,15 @@ g_menu_exporter_group_subscribe (GMenuExporterGroup *group,
       group->prepared = TRUE;
 
       menu = g_hash_table_lookup (group->menus, 0);
-      g_menu_exporter_menu_prepare (menu);
+
+      /* If the group was created by a subscription and does not yet
+       * exist, it won't have a root menu...
+       *
+       * That menu will be prepared if it is ever added (due to
+       * group->prepared == TRUE).
+       */
+      if (menu)
+        g_menu_exporter_menu_prepare (menu);
     }
 
   group->subscribed++;
@@ -468,6 +476,7 @@ g_menu_exporter_remote_subscribe (GMenuExporterRemote *remote,
   count = (gsize) g_hash_table_lookup (remote->watches, GINT_TO_POINTER (group_id));
   g_hash_table_insert (remote->watches, GINT_TO_POINTER (group_id), GINT_TO_POINTER (count + 1));
 
+  /* Group will be created (as empty/unsubscribed if it does not exist) */
   group = g_menu_exporter_lookup_group (remote->exporter, group_id);
   g_menu_exporter_group_subscribe (group, builder);
 }