freeciv-gtk2 crashes under Unity when using menubar in cities report

[Jacob Nevins]

(Filing against freeciv initially, but may turn out to be a bug in appmenu-gtk or thereabouts.)

On Ubuntu 13.04 with Unity, running the supplied Freeciv (2.3.2-1), using the menubar on the cities report (F4) -- not the individual city dialog -- can cause the freeciv-gtk2 client to crash (segfault).

Originally noticed when changing production, but simply fiddling with the menubar will cause a crash sooner or later. Steps to reproduce:
1. Start new game
2. Found a city (select Settlers, press B)
3. Open cities report (F4) and select the new city
4. Repeatedly click on "Production" menu (bottom left), popping and unpopping it. Within about ten open/close cycles, the client crashes for me.

Friend reports that this did not used to happen with the same workflow under Ubuntu 12.10 (which had the same version of Freeciv packaged) -- it seems to be new with 13.04.

There is some associated console spew [edited]:

When the Production menu is opened, we tend to get three repeats of:
(freeciv-gtk2:2466): LIBDBUSMENU-GTK-CRITICAL **: watch_submenu: assertion `GTK_IS_MENU_SHELL(menu)' failed

Sometimes we also see the following correlated with menubar activity:
(freeciv-gtk2:2466): GLib-GObject-CRITICAL **: g_closure_unref: assertion `closure->ref_count > 0' failed
(freeciv-gtk2:2466): GLib-GObject-WARNING **: g_object_weak_unref: couldn't find weak ref 0x7fdbe02e4e40(0x9fd8058)

or sometimes
(freeciv-gtk2:2534): GLib-GObject-CRITICAL **: g_closure_ref: assertion `closure->ref_count > 0' failed

I expect there are crash reports of this available on errors.ubuntu.com, but I don't currently have access to that. Backtraces I've seen have almost all frames in Gtk/dbusmenu/etc rather than freeciv proper.

We've had trouble with Unity's menu-bar-stealing arrangements before (bug #743265). Tellingly, I cannot reproduce the crash if I launch Freeciv with "UBUNTU_MENUPROXY= freeciv-gtk2" (no crash in any of my experiments, including 30 cycles).

As a result of the previous bug, this menu bar is decorated with the property "ubuntu-local" to tell appmenu-gtk/dbusmenu/etc to keep their hands off it. But the UBUNTU_MENUPROXY environment variable still makes a difference, suggesting that it's not *completely* ignoring this menubar. On the other hand, perhaps there's some bug in the way we set up this menubar that appmenu is tickling -- it doesn't seem to happen with any of the other "auxiliary" menubars (such as the Nations report).

[Jacob Nevins (0jacobnk-ulp)]

I've also reproduced the crash with a build of the latest Freeciv upstream code from this development branch (S2_3 r23154).

[Jacob Nevins (0jacobnk-ulp)]

A few weeks' crash-free running with "UBUNTU_MENUPROXY= freeciv-gtk2" has pretty much proven that this only happens with appmenu active.

I seem not to have attached the backtrace I intended to. Here it is (from a .crash file on the user's system, manually apport-retrace'd by me).

Stacktrace:
 #0 0x00007f9afedfb037 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
         resultvar = 0
         pid = 21498
         selftid = 21498
 #1 0x00007f9afedfe698 in __GI_abort () at abort.c:90
         save_stage = 2
         act = {__sigaction_handler = {sa_handler = 0x7fff050e66e0, sa_sigaction = 0x7fff050e66e0}, sa_mask = {__val = {140733278217856, 138, 140303713758357, 4294967301, 0, 138, 140303677566184, 66998496, 138, 140303684891056, 140303713785637, 161, 51, 140303681476504, 1, 0}}, sa_flags = 0, sa_restorer = 0x20}
         sigs = {__val = {32, 0 <repeats 15 times>}}
 #2 0x00007f9aff1f73b6 in g_assertion_message (domain=domain@entry=0x7f9aff4c0a4e "GLib-GObject", file=file@entry=0x7f9aff4c5808 "/build/buildd/glib2.0-2.36.0/./gobject/gsignal.c", line=line@entry=646, func=func@entry=0x7f9aff4c71b0 <__PRETTY_FUNCTION__.12149> "handler_unref_R", message=<optimised out>) at /build/buildd/glib2.0-2.36.0/./glib/gtestutils.c:1912
         lstr = "646\000\377\177\000\000\320b\016\005\377\177\000\000\000,\376\003\000\000\000\000\061lL\377\232\177\000"
         s = 0x3fe50e0 "P\270\067\004"
 #3 0x00007f9aff1f7914 in g_assertion_message_expr (domain=domain@entry=0x7f9aff4c0a4e "GLib-GObject", file=file@entry=0x7f9aff4c5808 "/build/buildd/glib2.0-2.36.0/./gobject/gsignal.c", line=line@entry=646, func=func@entry=0x7f9aff4c71b0 <__PRETTY_FUNCTION__.12149> "handler_unref_R", expr=expr@entry=0x7f9aff4c6c31 "hlist->tail_after == handler") at /build/buildd/glib2.0-2.36.0/./glib/gtestutils.c:1923
         s = <optimised out>
 #4 0x00007f9aff493521 in handler_unref_R (handler=<optimised out>, instance=<optimised out>, signal_id=<optimised out>) at /build/buildd/glib2.0-2.36.0/./gobject/gsignal.c:646
 No locals.
 #5 0x00007f9aff4a8de2 in handler_unref_R (handler=0x431ca30, instance=0x407c210, signal_id=1) at /build/buildd/glib2.0-2.36.0/./gobject/gsignal.c:646
         _g_boolean_var_ = 0
         hlist = <optimised out>
 #6 g_signal_handler_disconnect (instance=0x407c210, handler_id=<optimised out>) at /build/buildd/glib2.0-2.36.0/./gobject/gsignal.c:2590
         handler = 0x431ca30
         signal_id = 1
         __PRETTY_FUNCTION__ = "g_signal_handler_disconnect"
 #7 0x00007f9af16db5a7 in ?? () from /home/jtn/apport-sandbox/usr/lib/x86_64-linux-gnu/libdbusmenu-gtk.so.4
 No symbol table info available.
 #8 0x00007f9af16db68e in ?? () from /home/jtn/apport-sandbox/usr/lib/x86_64-linux-gnu/libdbusmenu-gtk.so.4
 No symbol table info available.
 #9 0x00007f9aff1b9a90 in g_datalist_clear (datalist=0x0) at /build/buildd/glib2.0-2.36.0/./glib/gdataset.c:277
         data = 0x405fb70
         i = 0
         __PRETTY_FUNCTION__ = "g_datalist_clear"
 #10 0x00007f9aff49d538 in g_object_unref (_object=0x40d5400) at /build/buildd/glib2.0-2.36.0/./gobject/gobject.c:3024
         weak_locations = <optimised out>
         object = 0x40d54...

[Jacob Nevins (0jacobnk-ulp)]

(Just had a report of this particular menubar disappearing entirely on Ubuntu 13.10:
http://www.freeciv.org/wiki/Forum:Dropdowns_disappear_with_upgrade_to_Ubuntu_13.10
Very new report and not confirmed to smell the same as this bug yet, but it's suspicious.)

[Jacob Nevins (0jacobnk-ulp)]

I wrote:
> Just had a report of this particular menubar disappearing entirely on Ubuntu 13.10

Turns out to be a completely different issue (bug #1242937) -- the way global menus worked was revamped in 13.10 (with a new component "unity-gtk-module"), so this 13.04 issue is unlikely to apply there.

Would still like this 13.04 issue resolved if possible...

[Jacob Nevins (0jacobnk-ulp)]

Ubuntu 13.04 reached end-of-life last month, and it looks like that's the only Ubuntu version affected.

Suggest this ticket is closed with whatever your "never got around to it" status is (Won't Fix, I suppose).
(I've marked as Invalid in the upstream bit of Launchpad, as it seems this is a Unity bug which we upstream could do nothing to work around.)