Comment 9 for bug 1063003

The crash is happening in dbusmenu_server_finalize() when the server frees its lookup_cache hashtable of DbusmenuMenuitems. When the hash table is freed, g_object_unref() is called on each of its values. This crash indicates that one of the pointers in the lookup cache isn't a GObject.

Since the lookup_cache code looks fine (g_object_ref() is called for each menuitem added into the lookup cache) my first guess is there's an unbalanced unref() in either indicator-sync or ubuntuone's client code s.t. the menuitem is destroyed prematurely leaving a dangling pointer in lookup_cache.

It looks like quite a few people are experiencing this. Does anyone subbed to this ticket have suggestions on how to trigger this crash?