[evolution-data-server/gnome-3-10] Bug 719720 - Refcount error in imapx_command_select_done()

[Matthew Barnes <mbarnes src gnome org>]

commit b70845d94720220f2d52c566c09f13d871adc7fc
Author: Matthew Barnes <mbarnes redhat com>
Date:   Wed Dec 4 12:14:52 2013 -0500

    Bug 719720 - Refcount error in imapx_command_select_done()
    
    We were finalizing the CamelIMAPXCommand too early, and then trying
    to use it further down in the logic.  This of course led to crashes.
    
    Failed command structures were also leaking.  Fixed that too.

 camel/camel-imapx-server.c |   19 +++++++++++++------
 1 files changed, 13 insertions(+), 6 deletions(-)
---
diff --git a/camel/camel-imapx-server.c b/camel/camel-imapx-server.c
index 5cf5dec..dedbb4a 100644
--- a/camel/camel-imapx-server.c
+++ b/camel/camel-imapx-server.c
@@ -3496,10 +3496,10 @@ imapx_command_select_done (CamelIMAPXServer *is,
        g_return_if_fail (CAMEL_IS_IMAPX_JOB (job));
 
        if (camel_imapx_command_set_error_if_failed (ic, &local_error)) {
-               GQueue failed = G_QUEUE_INIT;
+               CamelIMAPXCommandQueue *failed;
                GQueue trash = G_QUEUE_INIT;
                CamelFolder *folder;
-               GList *link;
+               GList *list, *link;
 
                c (is->tagprefix, "Select failed\n");
 
@@ -3510,6 +3510,8 @@ imapx_command_select_done (CamelIMAPXServer *is,
                is->state = IMAPX_INITIALISED;
                g_mutex_unlock (&is->priv->select_lock);
 
+               failed = camel_imapx_command_queue_new ();
+
                QUEUE_LOCK (is);
 
                if (folder != NULL) {
@@ -3534,17 +3536,20 @@ imapx_command_select_done (CamelIMAPXServer *is,
 
                while ((link = g_queue_pop_head (&trash)) != NULL) {
                        CamelIMAPXCommand *cw = link->data;
+                       camel_imapx_command_ref (cw);
                        camel_imapx_command_queue_delete_link (is->queue, link);
-                       g_queue_push_tail (&failed, cw);
+                       camel_imapx_command_queue_push_tail (failed, cw);
+                       camel_imapx_command_unref (cw);
                }
 
                QUEUE_UNLOCK (is);
 
-               while (!g_queue_is_empty (&failed)) {
-                       CamelIMAPXCommand *cw;
+               list = camel_imapx_command_queue_peek_head_link (failed);
+
+               for (link = list; link != NULL; link = g_list_next (link)) {
+                       CamelIMAPXCommand *cw = link->data;
                        CamelIMAPXJob *failed_job;
 
-                       cw = g_queue_pop_head (&failed);
                        failed_job = camel_imapx_command_get_job (cw);
 
                        if (!CAMEL_IS_IMAPX_JOB (failed_job)) {
@@ -3560,6 +3565,8 @@ imapx_command_select_done (CamelIMAPXServer *is,
                        cw->complete (is, cw);
                }
 
+               camel_imapx_command_queue_free (failed);
+
                camel_imapx_job_take_error (job, local_error);
                imapx_unregister_job (is, job);