Hi Zhenhua,

> Here the problem is that disconnect function could be invoked if remote IO is disconnected after our ppp instance is freed. So we should avoid to invoke io_disconnect() in below case.
> 
> Entering new phase: 5
> PPP: lcp: pppcp_timeout: current state 5:STOPPING
> PPP: lcp: pppcp_generate_event: current state 5:STOPPING
> PPP: event: 5 (TO-), action: 803, new_state: 3 (STOPPED)
> PPP: lcp: pppcp_this_layer_finished: current state 3:STOPPED
> Entering new phase: 0
> ofonod[3114]: src/emulator.c:ppp_disconnect() 
> Server: > \r\nNO CARRIER\r\n
> ofonod[3114]: Pcui:< \r\n^BOOT:20291346,0,0,0,20\r\n
> Server: < AT+CFUN=0\r
> ofonod[3114]: src/emulator.c:cfun_cb() set CFUN to 0
> Server: > \r\nOK\r\n
> 
> 
> (gdb) bt
> #0  0x0806faf6 in pppcp_generate_event (data=0x95bfde0, event_type=DOWN, packet=0x0, len=0)
>     at gatchat/ppp_cp.c:638
> #1  0x0806e9cd in io_disconnect (user_data=0x95bfde8) at gatchat/gatppp.c:349
> #2  0x001ea504 in g_source_callback_unref (cb_data=0x95a8678)
>     at /build/buildd/glib2.0-2.22.3/glib/gmain.c:1077
> #3  0x001eaace in g_source_destroy_internal (source=0x95a86b0, context=<value optimized out>, have_lock=1)
>     at /build/buildd/glib2.0-2.22.3/glib/gmain.c:856
> #4  0x001eaedb in g_main_dispatch (context=0x95a5f80) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:1985
> #5  IA__g_main_context_dispatch (context=0x95a5f80) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2513
> #6  0x001ee730 in g_main_context_iterate (context=0x95a5f80, block=<value optimized out>, dispatch=1, 
>     self=0x95a6c58) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2591
> #7  0x001eeb9f in IA__g_main_loop_run (loop=0x95a5ef0) at /build/buildd/glib2.0-2.22.3/glib/gmain.c:2799
> #8  0x08094548 in main (argc=1, argv=0xbffb8ba4) at src/main.c:227
> (gdb) frame 1
> #1  0x0806e9cd in io_disconnect (user_data=0x95bfde8) at gatchat/gatppp.c:349
> 349		pppcp_signal_down(ppp->lcp);
> (gdb) p ppp
> $6 = <value optimized out>
> (gdb) info local
> No locals.
> (gdb) 

It seems the real culprit is that GAtServer is not restoring the
io_disconnect on the GAtIO object in g_at_server_resume.  Why are we not
seeing this crash in test-server?

Regards,
-Denis