Created attachment 44228 [details] [review]
Patch.

When dbus_*_setup_with_g_main gets called to move a connection to a new main loop context, connection_setup_new_from_old is called.  It tries to iterate through ios and timeouts on the old context.  However, it calls dbus_watch_set_data, which ias the side-effect of freeing the old data, which has the side-effect of removing the handler from the old context, so we set tmp to tmp->next where tmp now points to an element which has just been freed.