diff -Nru gtk+3.0-3.18.9/debian/changelog gtk+3.0-3.18.9/debian/changelog
--- gtk+3.0-3.18.9/debian/changelog	2016-03-24 15:41:56.000000000 +0100
+++ gtk+3.0-3.18.9/debian/changelog	2016-05-30 17:24:11.000000000 +0200
@@ -1,3 +1,10 @@
+gtk+3.0 (3.18.9-1ubuntu4) UNRELEASED; urgency=medium
+
+  * debian/patches/GtkMenuTracker-don-t-try-to-deference-null-change_point.patch:
+    - don't segfault on some menu model changes (LP: #1296674)
+
+ -- Marco Trevisan (Treviño) <marco@ubuntu.com>  Mon, 30 May 2016 17:24:05 +0200
+
 gtk+3.0 (3.18.9-1ubuntu3) xenial; urgency=medium
 
   * Merge branch from Marco Trevisan to hide buttons in headerbar apps when
diff -Nru gtk+3.0-3.18.9/debian/patches/GtkMenuTracker-don-t-try-to-deference-null-change_point.patch gtk+3.0-3.18.9/debian/patches/GtkMenuTracker-don-t-try-to-deference-null-change_point.patch
--- gtk+3.0-3.18.9/debian/patches/GtkMenuTracker-don-t-try-to-deference-null-change_point.patch	1970-01-01 01:00:00.000000000 +0100
+++ gtk+3.0-3.18.9/debian/patches/GtkMenuTracker-don-t-try-to-deference-null-change_point.patch	2016-05-30 17:22:44.000000000 +0200
@@ -0,0 +1,59 @@
+Description: Don't deference invalid change_point in MenuTracker
+Author: Marco Trevisan <marco.trevisan@canonical.com>
+Bug-Ubuntu: https://launchpad.net/bugs/1296674
+Bug: https://bugzilla.gnome.org/show_bug.cgi?id=767028
+Forwarded: yes
+
+From fad259ad65262cdc0e9c27abfe76f73881729134 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
+Date: Mon, 30 May 2016 17:05:59 +0200
+Subject: [PATCH] GtkMenuTracker: don't try to deference *change_point when
+ it's NULL
+
+---
+ gtk/gtkmenutracker.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/gtk/gtkmenutracker.c b/gtk/gtkmenutracker.c
+index 2d39319..990ae7c 100644
+--- a/gtk/gtkmenutracker.c
++++ b/gtk/gtkmenutracker.c
+@@ -284,11 +284,14 @@ gtk_menu_tracker_remove_items (GtkMenuTracker  *tracker,
+ 
+   for (i = 0; i < n_items; i++)
+     {
+-      GtkMenuTrackerSection *subsection;
++      GtkMenuTrackerSection *subsection = NULL;
+       gint n;
+ 
+-      subsection = (*change_point)->data;
+-      *change_point = g_slist_delete_link (*change_point, *change_point);
++      if (*change_point)
++        {
++          subsection = (*change_point)->data;
++          *change_point = g_slist_delete_link (*change_point, *change_point);
++        }
+ 
+       n = gtk_menu_tracker_section_measure (subsection);
+       gtk_menu_tracker_section_free (subsection);
+@@ -431,10 +434,14 @@ gtk_menu_tracker_model_changed (GMenuModel *model,
+    * of items within each item of the section before the change point).
+    */
+   change_point = &section->items;
+-  for (i = 0; i < position; i++)
++
++  if (*change_point)
+     {
+-      offset += gtk_menu_tracker_section_measure ((*change_point)->data);
+-      change_point = &(*change_point)->next;
++      for (i = 0; i < position; i++)
++        {
++          offset += gtk_menu_tracker_section_measure ((*change_point)->data);
++          change_point = &(*change_point)->next;
++        }
+     }
+ 
+   /* We remove items in order and add items in reverse order.  This
+-- 
+1.9.1
+
diff -Nru gtk+3.0-3.18.9/debian/patches/series gtk+3.0-3.18.9/debian/patches/series
--- gtk+3.0-3.18.9/debian/patches/series	2016-03-24 15:41:56.000000000 +0100
+++ gtk+3.0-3.18.9/debian/patches/series	2016-05-30 17:22:44.000000000 +0200
@@ -26,3 +26,4 @@
 ubuntu_fileselector_behaviour.patch
 unity-border-radius.patch
 unity-headerbar-maximized-mode.patch
+GtkMenuTracker-don-t-try-to-deference-null-change_point.patch