soup-message-io: fix crash when doing unpause+cancel

soup_message_io_stop() was unreffing unpause_source (if it was set),
but it didn't actually own a ref on it, so this would crash.
Fortunately this would only happen if you unpaused a message and then
immediately cancelled it, which isn't very common. Fixes a sporadic
chunk-test crash though.

diff --git a/libsoup/soup-message-io.c b/libsoup/soup-message-io.c
index 03f8c0a..928b73e 100644 (file)
--- a/libsoup/soup-message-io.c
+++ b/libsoup/soup-message-io.c
@@ -1134,6 +1134,7 @@ soup_message_io_pause (SoupMessage *msg)
 
        if (io->unpause_source) {
                g_source_destroy (io->unpause_source);
+               g_source_unref (io->unpause_source);
                io->unpause_source = NULL;
        }
 
@@ -1147,6 +1148,8 @@ io_unpause_internal (gpointer msg)
        SoupMessageIOData *io = priv->io_data;
 
        g_return_val_if_fail (io != NULL, FALSE);
+
+       g_source_unref (io->unpause_source);
        io->unpause_source = NULL;
        io->paused = FALSE;
 
@@ -1173,7 +1176,7 @@ soup_message_io_unpause (SoupMessage *msg)
 
        if (!io->blocking) {
                if (!io->unpause_source) {
-                       io->unpause_source = soup_add_completion (
+                       io->unpause_source = soup_add_completion_reffed (
                                io->async_context, io_unpause_internal, msg);
                }
        } else