Looking at query_async in tracker-bus.vala:

The code issues a bus.send_message_with_reply.begin (wrapped by send_query), and while that is running it splices together a couple of streams asynchronously.

Suppose the GCancellable is used while we are waiting for the splice to yield (and the send_query is running in the background). This might cause the splice to yield before the callback for send_query is invoked. (If it happens the other way around, then we are OK.) In C, an error from splice_finish will lead to tracker_sparql_connection_query_async being completed after destroying the block that holds the scope for the send_query callback.

So, when the send_query callback is invoked as a result of the same cancellation, it will try to access memory that is invalid because its scope has already been destroyed.

Unfortunately, my Vala skills are limited and I am not sure of the exact Vala construct that should be used to fix this. The easiest option, ofcourse, is to not issue the send_query and splice simultaneously.