GIOScheduler: Fix access after free in "cancelled" handler

 * GCancellable can be "cancelled" more than once if
   g_cancellable_reset() is called.
 * Don't assume that because the "cancelled" signal fired
   it won't fire again.

https://bugzilla.gnome.org/show_bug.cgi?id=680111

diff --git a/gio/gioscheduler.c b/gio/gioscheduler.c
index 856e4b9df3d60da7f7bb065442d26ed62700f917..24c645149a9ae586c617ec1e123ac162e6d09c85 100644 (file)
--- a/gio/gioscheduler.c
+++ b/gio/gioscheduler.c
@@ -130,8 +130,8 @@ on_job_canceled (GCancellable    *cancellable,
 {
   GIOSchedulerJob *job = user_data;
 
+  /* This might be called more than once */
   job->io_priority = -1;
-  job->cancellable_id = 0;
 
   if (job_thread_pool != NULL)
     g_thread_pool_set_sort_function (job_thread_pool,