[BUG] Calling clutter_actor_destroy from JS makes the Shell SIGABRT

[Giovanni Campagna <scampa giovanni gmail com>]

This is a bug that can be experienced for example with the patch from
bug 618312 (the bluetooth indicator). To reproduce, enable then disable
bluetooth. Device items are removed from menu by calling .destroy on
PopupBaseMenuItem.

What is my experimental understanding is that calling .destroy on a
StBin corrupts the proxy of that (or another? can't really say, JS stack
when breaking on st_bin_dispose points to a wrong line) StBin and
results in a failed assertion (unreffing a finalized object).
I didn't post this in bugzilla because I am not sure where this bug
belongs:
- is this a gjs bug? Maybe g_object_run_dispose confuses the GC because
the object is dropping references to JS objects, as well as GObject.
Also, this is often preceded by some failed assertions in
g_object_add_toggle_ref / g_object_remove_toggle_ref
- is this a St bug? The proxy object is a [_private_St_Bin], so it
reasonable to assume that the GObject was an ST_TYPE_BIN (but I'm not
sure on this either, sometimes shell crashes with gjs trying to handle
an StBin with an StLabel prototype).
- is this a clutter bug? The method invoked is clutter_actor_destroy,
after all.

I'm sending this because I have no clue of the possible cause of this,
but it is really annoing to have the shell randomly crash (especially
because it corrupts ORBIT somehow, so the panel loads with no applets).

Thanks for you're time, I hope you'll solve this.

Giovanni