When using this .vala file:

http://git.gnome.org/browse/tracker/tree/src/libtracker-bus/tracker-bus.vala

and in particular looking at the generated function tracker_bus_connection_real_query_async_co, we notice that in the uncaught error else-block data->_async_result isn't unreffed like in the caught error case prior to returning the _co function.

I have attached an excerpt of the generated tracker-bus.c file for investigation purposes.

Vala version used was valac 0.11.4

if (data->_inner_error_ != NULL) {
	if (((data->_inner_error_->domain == TRACKER_SPARQL_ERROR) || (data->_inner_error_->domain == G_IO_ERROR)) || (data->_inner_error_->domain == G_DBUS_ERROR)) {
		g_simple_async_result_set_from_error (data->_async_result, data->_inner_error_);
		g_error_free (data->_inner_error_);
		_g_object_unref0 (data->output);
		_g_object_unref0 (data->input);
		block2_data_unref (data->_data2_);
		if (data->_state_ == 0) {
			g_simple_async_result_complete_in_idle (data->_async_result);
		} else {
			g_simple_async_result_complete (data->_async_result);
		}
		g_object_unref (data->_async_result);
		return FALSE;
	} else {
		_g_object_unref0 (data->output);
		_g_object_unref0 (data->input);
		block2_data_unref (data->_data2_);
		g_critical ("file %s: line %d: uncaught error: %s (%s, %d)", __FILE__, __LINE__, data->_inner_error_->message, g_quark_to_string (data->_inner_error_->domain), data->_inner_error_->code);
		g_clear_error (&data->_inner_error_);
		return FALSE;
	}
}