Unity8 welcome wizard crashes after changing language

[Michael Terry]

To reproduce:
- start the welcome wizard on an Ubuntu Touch phone
- click 'Continue'
- click 'Back'
- change language
- click 'Continue'
- click 'Back'

Repeat those last three steps a few times and you will eventually create a crash (usually within 5 tries).

It is because of a libqmenumodel bug triggered when we restart the indicators to force them to notice the new language.

Below is a stacktrace for the g_variant_unref failure (trying to unref a GVariant without any refs, with fatal-criticals turned on). The problem is that GtkMenuTrackerItem tries to unref its stored state GVariant on finalize, when it already unref'd it earlier. Branch attached to this bug.

#0 0xffffffff in () at /lib/arm-linux-gnueabihf/libc.so.6
#1 0xffffffff in raise () at /lib/arm-linux-gnueabihf/libc.so.6
#2 0xffffffff in g_logv (breakpoint=1)
    at /build/buildd/glib2.0-2.44.0/./glib/gmessages.c:315
#3 0xffffffff in g_logv (log_domain=0xb5cb1860 "GLib", log_level=log_level@entry=G_LOG_LEVEL_CRITICAL, format=format@entry=0xb39435bc <g.notify_lock_lock> "", args=..., args@entry=...)
    at /build/buildd/glib2.0-2.44.0/./glib/gmessages.c:1041
#4 0xffffffff in g_log (log_domain=<optimized out>, log_level=log_level@entry=G_LOG_LEVEL_CRITICAL, format=0xb5cba5dc "%s: assertion '%s' failed")
    at /build/buildd/glib2.0-2.44.0/./glib/gmessages.c:1079
#5 0xffffffff in g_return_if_fail_warning (log_domain=<optimized out>, pretty_function=<optimized out>, expression=<optimized out>)
    at /build/buildd/glib2.0-2.44.0/./glib/gmessages.c:1088
#6 0xffffffff in gtk_menu_tracker_item_finalize (object=0x10abae0 [GtkMenuTrackerItem])
    at /build/buildd/qmenumodel-0.2.9+15.04.20150108/libqmenumodel/src/gtk/gtkmenutrackeritem.c:205
#7 0xffffffff in g_object_unref (_object=0x10abae0)
    at /build/buildd/glib2.0-2.44.0/./gobject/gobject.c:3174
#8 0xffffffff in real_node_free (node=0xade173c0, seq=0x10df290)
    at /build/buildd/glib2.0-2.44.0/./glib/gsequence.c:1793
#9 0xffffffff in UnityMenuModel::event(QEvent*) (this=
---Type <return> to continue, or q <return> to quit---
    0xfa4970, e=<optimized out>)
    at /build/buildd/qmenumodel-0.2.9+15.04.20150108/libqmenumodel/src/unitymenumodel.cpp:789
#10 0xffffffff in QCoreApplication::notify(QObject*, QEvent*) ()
    at /usr/lib/arm-linux-gnueabihf/libQt5Core.so.5
#11 0xffffffff in QCoreApplication::notifyInternal(QObject*, QEvent*) ()
    at /usr/lib/arm-linux-gnueabihf/libQt5Core.so.5
#12 0xffffffff in UnityMenuModelPrivate::menuItemRemoved(int, void*) (event=0xbedfeb04, receiver=<optimized out>)
    at /usr/include/arm-linux-gnueabihf/qt5/QtCore/qcoreapplication.h:237
#13 0xffffffff in UnityMenuModelPrivate::menuItemRemoved(int, void*) (position=<optimized out>, user_data=0xc5c160)
    at /build/buildd/qmenumodel-0.2.9+15.04.20150108/libqmenumodel/src/unitymenumodel.cpp:260
#14 0xffffffff in gtk_menu_tracker_model_changed (tracker=0xade18b48, tracker=0xade18b48, n_items=1, offset=0, change_point=0xade18b34)
    at /build/buildd/qmenumodel-0.2.9+15.04.20150108/libqmenumodel/src/gtk/gtkmenutracker.c:257
#15 0xffffffff in gtk_menu_tracker_model_changed (model=0x1185660 [GDBusMenuModel], position=0, removed=1, added=0, user_data=0xade18b48)
    at /build/buildd/qmenumodel-0.2.9+15.04.20150108/libqmenumodel/src/gtk/gtkmenutracker.c:354
#16 0xffffffff in ffi_call_VFP () at /usr/lib/arm-linux-gnueabihf/libffi.so.6
---Type <return> to continue, or q <return> to quit---
#17 0xffffffff in ffi_call () at /usr/lib/arm-linux-gnueabihf/libffi.so.6
#22 0xffffffff in <emit signal ??? on instance 0x1185660 [GDBusMenuModel]> (instance=<optimized out>, signal_id=<optimized out>, detail=0)
    at /build/buildd/glib2.0-2.44.0/./gobject/gsignal.c:3361
    #18 0xffffffff in g_cclosure_marshal_generic (closure=<optimized out>, return_gvalue=<optimized out>, n_param_values=4, param_values=<optimized out>, invocation_hint=0xbedfede8, marshal_data=0x0)
    at /build/buildd/glib2.0-2.44.0/./gobject/gclosure.c:1448
    #19 0xffffffff in g_closure_invoke (closure=0xed0ac0, return_value=0x0, n_param_values=4, param_values=0xbedfee30, invocation_hint=0xbedfede8)
    at /build/buildd/glib2.0-2.44.0/./gobject/gclosure.c:768
    #20 0xffffffff in signal_emit_unlocked_R (node=node@entry=0x85f3b8, detail=detail@entry=0, instance=0x1185660,
    instance@entry=0xb6226000, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0xbedfee30)
    at /build/buildd/glib2.0-2.44.0/./gobject/gsignal.c:3549
    #21 0xffffffff in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=detail@entry=3202346924, var_args=...,
    var_args@entry=...)
    at /build/buildd/glib2.0-2.44.0/./gobject/gsignal.c:3305
#23 0xffffffff in g_menu_model_items_changed (model=<optimized out>, position=position@entry=0, removed=removed@entry=1, added=added@entry=0)
    at /build/buildd/glib2.0-2.44.0/./gio/gmenumodel.c:688
---Type <return> to continue, or q <return> to quit---
#24 0xffffffff in g_dbus_menu_group_changed (added=0, removed=1, position=0, items=0xb95310, proxy=<optimized out>)
    at /build/buildd/glib2.0-2.44.0/./gio/gdbusmenumodel.c:832
#25 0xffffffff in g_dbus_menu_group_changed (group=0x1185640, menu_id=0, position=0, removed=1, added=added@entry=0xade16408)
    at /build/buildd/glib2.0-2.44.0/./gio/gdbusmenumodel.c:635
#26 0xffffffff in g_dbus_menu_path_signal (connection=<optimized out>, sender_name=<optimized out>, object_path=<optimized out>, interface_name=<optimized out>, signal_name=0xade13e60 "Changed", parameters=0xade0fd00, user_data=0xbea6c0)
    at /build/buildd/glib2.0-2.44.0/./gio/gdbusmenumodel.c:298
#27 0xffffffff in emit_signal_instance_in_idle_cb (data=<optimized out>)
    at /build/buildd/glib2.0-2.44.0/./gio/gdbusconnection.c:3753
#28 0xffffffff in g_main_context_dispatch (context=0x6fd958)
    at /build/buildd/glib2.0-2.44.0/./glib/gmain.c:3122
#29 0xffffffff in g_main_context_dispatch (context=context@entry=0x6fd958)
    at /build/buildd/glib2.0-2.44.0/./glib/gmain.c:3737
#30 0xffffffff in g_main_context_iterate (context=context@entry=0x6fd958, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
    at /build/buildd/glib2.0-2.44.0/./glib/gmain.c:3808
#31 0xffffffff in g_main_context_iteration (context=0x6fd958, may_block=1)
    at /build/buildd/glib2.0-2.44.0/./glib/gmain.c:3869
#32 0xffffffff in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/arm-linux-gnueabihf/libQt5Core.so.5
---Type <return> to continue, or q <return> to quit---
#33 0xffffffff in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) ()
    at /usr/lib/arm-linux-gnueabihf/libQt5Core.so.5
#34 0xffffffff in QCoreApplication::exec() ()
    at /usr/lib/arm-linux-gnueabihf/libQt5Core.so.5
#35 0x000156a0 in main(int, char const**) (argc=1, argv=0xbedff4a4)
    at /home/phablet/u8/trunk/src/main.cpp:121

[Leo Arias (elopio)]

The fix in the branch comes with no test. Should we add a regression test in unity to go forth and back on the wizard pages?

[Michael Terry (mterry)]

The fix in the branch was a no-brainer fix. Testing that one-line fix specifically inside qmenumodel would be like testing to make sure a directory exists after you mkdir it.

But! The general principle of testing that behavior -- going back and forth on the wizard pages while changing language -- is good. That exercises a lot of moving parts (restarting all the indicators, the OSK keyboard, changing UI strings, etc). So it's a good regression test.

So I think a high-level functional test like that would be useful, yes.

[Launchpad Janitor (janitor)]

This bug was fixed in the package qmenumodel - 0.2.9+15.04.20150430-0ubuntu1

---------------
qmenumodel (0.2.9+15.04.20150430-0ubuntu1) vivid; urgency=medium

  [ Michael Terry ]
  * Don't leave a dangling GVariant pointer in GtkMenuTrackerItem, which
    can cause a crash. (LP: #1450494)

qmenumodel (0.2.9+15.04.20150108-0ubuntu1) vivid; urgency=medium

  [ Nick Dedekind ]
  * Added support for overriding QDBusActionGroup state parser

qmenumodel (0.2.8+14.10.20141013-0ubuntu1) utopic; urgency=low

  [ Nick Dedekind ]
  * Disconnect QDBusActionGroup add/remove/stateChange signals when
    deleting object. (LP: #1378941)

qmenumodel (0.2.8+14.10.20140815-0ubuntu1) utopic; urgency=low

  [ Nick Dedekind ]
  * Allow remote URIs to be used from file serialized icons

qmenumodel (0.2.8+14.10.20140717-0ubuntu1) utopic; urgency=medium

  [ Lars Uebernickel ]
  * unitymenumodel: add nameOwner property

qmenumodel (0.2.7+14.10.20140704-0ubuntu1) utopic; urgency=low

  [ Charles Kerr ]
  * Fix a dangling UnityMenuAction pointer by ensuring it's registered
    with only one menu at a time. (LP: #1282282)

  [ Nick Dedekind ]
  * Unset the UnityMenuActions::model when destroying UnityMenuModel
    (LP: #1334203)

qmenumodel (0.2.7+14.10.20140514.1-0ubuntu1) utopic; urgency=medium

  [ Antti Kaijanmäki ]
  * Add standard "has the property actually changed"
    check to UnityMenuModel::setBusName()

qmenumodel (0.2.7+14.04.20140305-0ubuntu2) trusty; urgency=medium

  * No-change rebuild for shlib changes in qtbase and qtdeclarative.

qmenumodel (0.2.7+14.04.20140305-0ubuntu1) trusty; urgency=low

  [ CI bot ]
  * No change rebuild against Qt 5.2.1.

  [ Albert Astals ]
  * Fix use of un-initialized memory Since m_valid was not initialized
    calling setValid ends up in an uninitialized memory use in the if
    comparison. The other thing setValid does is emitting a signal, but
    this is the constructor, so you don't need the signal either, so
    basically just assign the variable directly .

  [ Ubuntu daily release ]
  * New rebuild forced

qmenumodel (0.2.7+14.04.20131213-0ubuntu1) trusty; urgency=low

  [ Nick Dedekind ]
  * Added dataChange to loadExtendedAttributes function.

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 99

qmenumodel (0.2.7+14.04.20131125-0ubuntu1) trusty; urgency=low

  [ Marcus Tomlinson ]
  * Fixed #define guard.

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 97

qmenumodel (0.2.7+13.10.20131016-0ubuntu1) saucy; urgency=low

  [ Gustavo Pichorim Boiko ]
  * Use g_file_get_uri instead of g_file_get_path to make sure the URI's
    percent encoding is properly kept.

  [ Nick Dedekind ]
  * Added pointer checks for items/iterators. (lp#1239394). (LP:
    #1239394)

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 95

qmenumodel (0.2.7+13.10.20131011-0ubuntu1) saucy; urgency=low

  [ Lars Uebernickel ]
  * QStateAction: try to maintain the type of the action's state QML
    likes to convert doubles to integers if the number is close enough
    to an integer. This tries to circumvent that by explicitly casting
    to the right action type, because that's what exporters of
    GA...