2 files changed, 15 insertions, 8 deletions
diff --git a/src/core/hle/kernel/client_session.cpp b/src/core/hle/kernel/client_session.cpp
index 6bc49ff64..fef97af1f 100644
--- a/src/core/hle/kernel/client_session.cpp
+++ b/src/core/hle/kernel/client_session.cpp
@@ -8,6 +8,7 @@
 #include "core/hle/kernel/errors.h"
 #include "core/hle/kernel/hle_ipc.h"
 #include "core/hle/kernel/server_session.h"
+#include "core/hle/kernel/session.h"
 
 namespace Kernel {
 
@@ -16,9 +17,13 @@ ClientSession::~ClientSession() {
     // This destructor will be called automatically when the last ClientSession handle is closed by
     // the emulated application.
 
-    if (parent->server) {
-        if (parent->server->hle_handler)
-            parent->server->hle_handler->ClientDisconnected(parent->server);
+    // Local references to ServerSession and SessionRequestHandler are necessary to guarantee they
+    // will be kept alive until after ClientDisconnected() returns.
+    SharedPtr<ServerSession> server = parent->server;
+    if (server) {
+        std::shared_ptr<SessionRequestHandler> hle_handler = server->hle_handler;
+        if (hle_handler)
+            hle_handler->ClientDisconnected(server);
 
         // TODO(Subv): Force a wake up of all the ServerSession's waiting threads and set
         // their WaitSynchronization result to 0xC920181A.
@@ -28,11 +33,13 @@ ClientSession::~ClientSession() {
 }
 
 ResultCode ClientSession::SendSyncRequest() {
-    // Signal the server session that new data is available
-    if (parent->server)
-        return parent->server->HandleSyncRequest();
+    // Keep ServerSession alive until we're done working with it.
+    SharedPtr<ServerSession> server = parent->server;
+    if (server == nullptr)
+        return ERR_SESSION_CLOSED_BY_REMOTE;
 
-    return ERR_SESSION_CLOSED_BY_REMOTE;
+    // Signal the server session that new data is available
+    return server->HandleSyncRequest();
 }
 
 } // namespace
diff --git a/src/core/hle/kernel/server_session.h b/src/core/hle/kernel/server_session.h
index 28f365b9e..5365605da 100644
--- a/src/core/hle/kernel/server_session.h
+++ b/src/core/hle/kernel/server_session.h
@@ -9,7 +9,6 @@
 #include "common/assert.h"
 #include "common/common_types.h"
 #include "core/hle/kernel/kernel.h"
-#include "core/hle/kernel/session.h"
 #include "core/hle/kernel/wait_object.h"
 #include "core/hle/result.h"
 #include "core/memory.h"
@@ -19,6 +18,7 @@ namespace Kernel {
 class ClientSession;
 class ClientPort;
 class ServerSession;
+class Session;
 class SessionRequestHandler;
 class Thread;