On error, we call ibis_client_stop, which disconnects the client, and through various signals and callbacks disconnects the account in the protocol plugin. This drops the toplevel owning ref, but ibis_client_read_cb is still connected and gets a callback from some server input. At this point it parses the input and emits a signal for the received message, which adds and removes a ref. The client is still valid then, but when the ref is removed, GObject realizes there are only weak refs left and frees it entirely. Then when ibis_client_read_cb attempts to use client later, it's invalid memory.
Since these callbacks are on the GInputStream, the client is its data, and we need to add a ref for the duration of the callback so that it doesn't disappear under the callback.

Connected to rizon, and entered the wrong password 3 times, causing the server to kill the connection, and this no longer crashed.