diff --git a/ChangeLog b/ChangeLog
index 42ff1d96..a02394a6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2007-07-18  Havoc Pennington  <hp@redhat.com>
+
+	* dbus/dbus-message.c (dbus_message_get_cached)
+	(dbus_message_cache_or_finalize): don't mess with message from
+	message cache outside of the cache lock. Bug #9164 from Jonathan
+	Matthew.
+
 2007-07-13  Havoc Pennington  <hp@redhat.com>
 
 	* Add indent-tabs-mode: nil to all file headers.
diff --git a/dbus/dbus-message.c b/dbus/dbus-message.c
index 1c92af26..91f6ebec 100644
--- a/dbus/dbus-message.c
+++ b/dbus/dbus-message.c
@@ -482,10 +482,10 @@ dbus_message_get_cached (void)
   _dbus_assert (i < MAX_MESSAGE_CACHE_SIZE);
   _dbus_assert (message != NULL);
 
-  _DBUS_UNLOCK (message_cache);
-
   _dbus_assert (message->refcount.value == 0);
   _dbus_assert (message->size_counters == NULL);
+  
+  _DBUS_UNLOCK (message_cache);
 
   return message;
 }
@@ -571,10 +571,10 @@ dbus_message_cache_or_finalize (DBusMessage *message)
 #endif
 
  out:
-  _DBUS_UNLOCK (message_cache);
-
   _dbus_assert (message->refcount.value == 0);
   
+  _DBUS_UNLOCK (message_cache);
+  
   if (!was_cached)
     dbus_message_finalize (message);
 }