Markus' mutter.crash.retraced dump indicates what I suspected. The callback we get from dbus-glib passes in invalid data to clone_callback() function's 4th argument (GPtrArray rows) (dee-shared-model.c line 1055 in the attached branch).
This probably means that there is a double free or something in dbus-glib. Further investigation is needed.
Thanks Markus!
Markus' mutter. crash.retraced dump indicates what I suspected. The callback we get from dbus-glib passes in invalid data to clone_callback() function's 4th argument (GPtrArray rows) (dee-shared-model.c line 1055 in the attached branch).
This probably means that there is a double free or something in dbus-glib. Further investigation is needed.