find_matching_channel_requests is used to figure out which requests are
satisfied or failed by TpChannelFactoryIface::new-channel and
::channel-error, respectively. But, in a pathological connection manager
where channels with the same ChannelType, TargetHandleType and
TargetHandle are sometimes managed by a TpChannelManager and other times
by a TpChannelFactoryIface, if the Factory signals something with that
CT, THT and TH first then the ChannelRequest known to the Manager will
be returned by find_matching_channel_requests. It will then be
prematurely answered and freed; when the Manager signals that token,
tp-glib will crash.
Being in this situation in the first place is insane, though.
Actually, since TpChannelFactoryIface is already marked as deprecated, it's covered by “get rid of everything deprecated” over on bug 31668!
*** This bug has been marked as a duplicate of bug 31668 ***