IOSource and its friends are getting ref counting wrong.  The various create methods ( IoSource::create, TimeoutSource::create, etc ) return a RefPtr.  This RefPtr calls Source::unreference when it is destroyed to release the reference on the source object.  This in turn calls g_source_unref(gobject_).  This pointer is set to NULL by Source::destroy_notify_callback.

In other words, if the source is destroyed while the RefPtr still exists, for example, because the timeout returned false, then this NULLs the gobject_ pointer, loosing the g_source_object while it still has a reference count on it, and later when the RefPtr tries to release it, g_source_unref() complains because it is being called on a NULL pointer, and you now have a leaked object.