[seed] fix toggle refs

[Alan Knowles <alank src gnome org>]

commit a7a2627b527000749d595b6aa8dcfe018ff306dd
Author: Alban Crequy <alban crequy collabora co uk>
Date:   Fri Apr 26 19:18:51 2013 +0100

    fix toggle refs
    
    When an object is unreffed from other C code and the last reference is the seed
    toggle reference, g_object_remove_toggle_ref() could be called from
    seed_gobject_finalize() through the javascript garbage collector.
    
    The "data" parameter given to g_object_remove_toggle_ref() must be the same as
    the one used at g_object_add_toggle_ref-time in seed_wrap_object(), otherwise
    the toggle callback seed_toggle_ref will not be called and a critical warning
    "couldn't find toggle ref" might be printed.
    
    Additionally, g_object_run_dispose() must not be called after
    g_object_remove_toggle_ref() since gobject will be freed by then.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=698988

 libseed/seed-engine.c |   11 ++++++++---
 1 files changed, 8 insertions(+), 3 deletions(-)
---
diff --git a/libseed/seed-engine.c b/libseed/seed-engine.c
index 4a573bc..473850e 100644
--- a/libseed/seed-engine.c
+++ b/libseed/seed-engine.c
@@ -1153,6 +1153,7 @@ static void
 seed_gobject_finalize (JSObjectRef object)
 {
   GObject *gobject;
+  JSObjectRef js_ref;
 
   gobject = (GObject *) JSObjectGetPrivate ((JSObjectRef) object);
   if (!gobject)
@@ -1166,13 +1167,17 @@ seed_gobject_finalize (JSObjectRef object)
             g_type_name (G_OBJECT_TYPE (gobject)), gobject,
             gobject->ref_count);
 
-  if (g_object_get_data (gobject, "js-ref"))
+  js_ref = g_object_get_data (gobject, "js-ref");
+  if (js_ref)
     {
       g_object_set_data_full (gobject, "js-ref", NULL, NULL);
 
-      g_object_remove_toggle_ref (gobject, seed_toggle_ref, 0);
+      g_object_remove_toggle_ref (gobject, seed_toggle_ref, js_ref);
+    }
+  else
+    {
+      g_object_run_dispose (gobject);
     }
-  g_object_run_dispose (gobject);
 }
 
 static JSValueRef