Bug 331927

running gnucash 2.6.2 in Suse 13.1 caused gnucash to segfault

back trace included

also happens under RHat

Reproducible: Always

Steps to Reproduce:
1.select oxygen in kde setup
2.run gnucash
3.eventually crashes when mouse focus on menu bar
Actual Results:  
segfault

Expected Results:  
no segfault

<clip>
      handler_list = 0x0
        return_accu = 0x7fffffffc870
        accu = {g_type = 20, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, 
              v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, 
              v_double = 0, v_pointer = 0x0}}}
        signal_id = 59
        max_sequential_handler_number = 8028
        return_value_altered = 0
#51 0x00007fffef295689 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, 
    var_args=var_args@entry=0x7fffffffcab8) at gsignal.c:3340
        return_value = {g_type = 20, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, 
              v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, 
              v_double = 0, v_pointer = 0x0}}}
        error = 0x0
        rtype = 20
        static_scope = 0
        instance_and_params = 0x7fffffffc920
        signal_return_type = <optimized out>
        param_values = 0x7fffffffc938
        i = <optimized out>
        n_params = <optimized out>
        __PRETTY_FUNCTION__ = "g_signal_emit_valist"
        __FUNCTION__ = "g_signal_emit_valist"
#52 0x00007fffef295c72 in g_signal_emit (instance=instance@entry=0x75fd30, signal_id=<optimized out>, detail=detail@entry=0)
    at gsignal.c:3386
        var_args = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x7fffffffcb90, reg_save_area = 0x7fffffffcad0}}
#53 0x00007ffff0af0864 in gtk_widget_event_internal (widget=widget@entry=0x75fd30, event=event@entry=0x4b0bdd0) at gtkwidget.c:5017
        signal_num = <optimized out>
        return_val = 0
#54 0x00007ffff0af0c81 in IA__gtk_widget_send_expose (widget=widget@entry=0x75fd30, event=event@entry=0x4b0bdd0) at gtkwidget.c:4846
        __PRETTY_FUNCTION__ = "IA__gtk_widget_send_expose"
#55 0x00007ffff0969548 in IA__gtk_container_propagate_expose (container=<optimized out>, child=0x75fd30, event=0x7fffffffd100)
    at gtkcontainer.c:2757
        child_event = 0x4b0bdd0
        __PRETTY_FUNCTION__ = "IA__gtk_container_propagate_expose"
        __FUNCTION__ = "IA__gtk_container_propagate_expose"
#56 0x00007ffff09680d4 in gtk_container_expose (widget=0x722a00, event=0x7fffffffd100) at gtkcontainer.c:2661
        data = {container = 0x722a00, event = 0x7fffffffd100}
        __PRETTY_FUNCTION__ = "gtk_container_expose"
#57 0x00007ffff09e09d5 in _gtk_marshal_BOOLEAN__BOXED (closure=0x7315b0, return_value=0x7fffffffcd30, n_param_values=<optimized out>, 
    param_values=0x7fffffffcde0, invocation_hint=<optimized out>, marshal_data=0x7ffff0afd0f0 <gtk_window_expose>) at gtkmarshalers.c:86
        callback = <optimized out>
        cc = <optimized out>
        data1 = 0x722a00
        data2 = <optimized out>
        v_return = <optimized out>
        __PRETTY_FUNCTION__ = "_gtk_marshal_BOOLEAN__BOXED"
#58 0x00007fffef27c318 in g_closure_invoke (closure=0x7315b0, return_value=0x7fffffffcd30, n_param_values=2, 
    param_values=0x7fffffffcde0, invocation_hint=0x7fffffffcd80) at gclosure.c:777
        marshal = 0x7fffef27ac10 <g_type_class_meta_marshal>
        marshal_data = 0x188
        in_marshal = 0
        real_closure = 0x731590
        __PRETTY_FUNCTION__ = "g_closure_invoke"
#59 0x00007fffef28da6b in signal_emit_unlocked_R (node=node@entry=0x6ad140, detail=detail@entry=0, instance=instance@entry=0x722a00, 
    emission_return=emission_return@entry=0x7fffffffceb0, instance_and_params=instance_and_params@entry=0x7fffffffcde0) at gsignal.c:3624
        accumulator = 0x731600
        emission = {next = 0x0, instance = 0x722a00, ihint = {signal_id = 59, detail = 0, run_type = G_SIGNAL_RUN_LAST}, 
          state = EMISSION_RUN, chain_type = 9179056}
        handler_list = 0x0
        return_accu = 0x7fffffffcd30
        accu = {g_type = 20, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, 
              v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, 
              v_double = 0, v_pointer = 0x0}}}
        signal_id = 59
        max_sequential_handler_number = 8028
        return_value_altered = 0
#60 0x00007fffef295689 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, 
    var_args=var_args@entry=0x7fffffffcf78) at gsignal.c:3340
        return_value = {g_type = 20, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, 
              v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, 
              v_double = 0, v_pointer = 0x0}}}
        error = 0x0
        rtype = 20
        static_scope = 0
        instance_and_params = 0x7fffffffcde0
        signal_return_type = <optimized out>
        param_values = 0x7fffffffcdf8
        i = <optimized out>
        n_params = <optimized out>
        __PRETTY_FUNCTION__ = "g_signal_emit_valist"
        __FUNCTION__ = "g_signal_emit_valist"
#61 0x00007fffef295c72 in g_signal_emit (instance=instance@entry=0x722a00, signal_id=<optimized out>, detail=detail@entry=0)
    at gsignal.c:3386
        var_args = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x7fffffffd050, reg_save_area = 0x7fffffffcf90}}
#62 0x00007ffff0af0864 in gtk_widget_event_internal (widget=widget@entry=0x722a00, event=event@entry=0x7fffffffd100) at gtkwidget.c:5017
        signal_num = <optimized out>
        return_val = 0
#63 0x00007ffff0af0c81 in IA__gtk_widget_send_expose (widget=widget@entry=0x722a00, event=event@entry=0x7fffffffd100) at gtkwidget.c:4846
        __PRETTY_FUNCTION__ = "IA__gtk_widget_send_expose"
#64 0x00007ffff09df7d0 in IA__gtk_main_do_event (event=0x7fffffffd100) at gtkmain.c:1610
        event_widget = 0x722a00
        grab_widget = 0x722a00
        window_group = 0x759f40
        rewritten_event = <optimized out>
        tmp_list = <optimized out>
        __FUNCTION__ = "IA__gtk_main_do_event"
#65 0x00007ffff063776f in _gdk_window_process_updates_recurse (window=window@entry=0x689a20, expose_region=expose_region@entry=0x224b8d0)
    at gdkwindow.c:5427
        event = {type = GDK_EXPOSE, any = {type = GDK_EXPOSE, window = 0x689a20, send_event = 0 '\000'}, expose = {type = GDK_EXPOSE, 
            window = 0x689a20, send_event = 0 '\000', area = {x = 260, y = 17, width = 34, height = 31}, region = 0x224b8d0, count = 0}, 
          no_expose = {type = GDK_EXPOSE, window = 0x689a20, send_event = 0 '\000'}, visibility = {type = GDK_EXPOSE, window = 0x689a20, 
            send_event = 0 '\000', state = (unknown: 260)}, motion = {type = GDK_EXPOSE, window = 0x689a20, send_event = 0 '\000', 
            time = 260, x = 7.2147856901218375e-313, y = 1.5316035021078643e-322, axes = 0x224b8d0, state = 0, is_hint = 0, 
            device = 0x224b930, x_root = 9.8813129168249309e-324, y_root = 1.7767161883024901e-316}, button = {type = GDK_EXPOSE, 
            window = 0x689a20, send_event = 0 '\000', time = 260, x = 7.2147856901218375e-313, y = 1.5316035021078643e-322, 
            axes = 0x224b8d0, state = 0, button = 0, device = 0x224b930, x_root = 9.8813129168249309e-324, 
            y_root = 1.7767161883024901e-316}, scroll = {type = GDK_EXPOSE, window = 0x689a20, send_event = 0 '\000', time = 260, 
            x = 7.2147856901218375e-313, y = 1.5316035021078643e-322, state = 35961040, direction = GDK_SCROLL_UP, device = 0x0, 
            x_root = 1.7767161883024901e-316, y_root = 9.8813129168249309e-324}, key = {type = GDK_EXPOSE, window = 0x689a20, 
            send_event = 0 '\000', time = 260, state = 17, keyval = 34, length = 31, string = 0x224b8d0 "\001", hardware_keycode = 0, 
            group = 0 '\000', is_modifier = 0}, crossing = {type = GDK_EXPOSE, window = 0x689a20, send_event = 0 '\000', 
            subwindow = 0x2200000011, time = 31, x = 1.7767114452722901e-316, y = 0, x_root = 1.7767161883024901e-316, 
            y_root = 9.8813129168249309e-324, mode = 35961136, detail = GDK_NOTIFY_ANCESTOR, focus = 67123008, state = 0}, 
          focus_change = {type = GDK_EXPOSE, window = 0x689a20, send_event = 0 '\000', in = 544}, configure = {type = GDK_EXPOSE, 
            window = 0x689a20, send_event = 0 '\000', x = 260, y = 17, width = 34, height = 31}, property = {type = GDK_EXPOSE, 
            window = 0x689a20, send_event = 0 '\000', atom = 0x2200000011, time = 31, state = 0}, selection = {type = GDK_EXPOSE, 
            window = 0x689a20, send_event = 0 '\000', selection = 0x2200000011, target = 0x1f, property = 0x224b8d0, time = 0, 
            requestor = 0}, owner_change = {type = GDK_EXPOSE, window = 0x689a20, send_event = 0 '\000', owner = 260, 
            reason = (GDK_OWNER_CHANGE_DESTROY | unknown: 16), selection = 0x1f, time = 35961040, selection_time = 0}, proximity = {
            type = GDK_EXPOSE, window = 0x689a20, send_event = 0 '\000', time = 260, device = 0x2200000011}, client = {
            type = GDK_EXPOSE, window = 0x689a20, send_event = 0 '\000', message_type = 0x2200000011, data_format = 31, data = {
              b = "\320\270$\002", '\000' <repeats 12 times>, "\060\271$\002", s = {-18224, 548, 0, 0, 0, 0, 0, 0, -18128, 548}, l = {
                35961040, 0, 35961136, 2, 35961136}}}, dnd = {type = GDK_EXPOSE, window = 0x689a20, send_event = 0 '\000', 
            context = 0x2200000011, time = 31, x_root = 0, y_root = 0}, window_state = {type = GDK_EXPOSE, window = 0x689a20, 
            send_event = 0 '\000', changed_mask = (GDK_WINDOW_STATE_MAXIMIZED | unknown: 256), 
            new_window_state = (GDK_WINDOW_STATE_WITHDRAWN | GDK_WINDOW_STATE_FULLSCREEN)}, setting = {type = GDK_EXPOSE, 
            window = 0x689a20, send_event = 0 '\000', action = (unknown: 260), 
            name = 0x2200000011 <Address 0x2200000011 out of bounds>}, grab_broken = {type = GDK_EXPOSE, window = 0x689a20, 
            send_event = 0 '\000', keyboard = 260, implicit = 17, grab_window = 0x1f}}
        private = 0x689a20
        child = <optimized out>
        child_region = <optimized out>
        r = {x = 0, y = 0, width = 1048, height = 17}
        l = <optimized out>
        children = 0x4248a60 = {0x4225ae0}
#66 0x00007ffff0665125 in _gdk_windowing_window_process_updates_recurse (window=window@entry=0x689a20, region=region@entry=0x224b8d0)
    at gdkwindow-x11.c:5643
No locals.
#67 0x00007ffff06343ae in gdk_window_process_updates_internal (window=0x689a20) at gdkwindow.c:5594
        expose_region = 0x224b8d0
        update_area = 0x224b930
        private = 0x689a20
        impl_iface = <optimized out>
        save_region = 0
        clip_box = {x = 260, y = 17, width = 34, height = 31}
        iteration = <optimized out>
#68 0x00007ffff0634c98 in IA__gdk_window_process_all_updates () at gdkwindow.c:5702
        private = 0x689a20
        old_update_windows = 0x439ba90 = {0x689a20}
        tmp_list = 0x439ba90 = {0x689a20}
        in_process_all_updates = 1
        got_recursive_update = 0
#69 0x00007ffff0634cf9 in gdk_window_update_idle (data=<optimized out>) at gdkwindow.c:5320
No locals.
#70 0x00007ffff0614537 in gdk_threads_dispatch (data=0x2290e60) at gdk.c:512
        dispatch = 0x2290e60
        ret = 0
#71 0x00007fffeefb3316 in g_main_dispatch (context=0x68b000) at gmain.c:3066
        dispatch = 0x7fffeefb0370 <g_idle_dispatch>
        was_in_call = 0
        user_data = 0x2290e60
        callback = 0x7ffff06144e0 <gdk_threads_dispatch>
        cb_funcs = 0x7fffef269920 <g_source_callback_funcs>
        cb_data = 0x3f2d860
        need_destroy = <optimized out>
        current_source_link = {data = 0x3f17380, next = 0x0}
        source = 0x3f17380
        current = 0x612800
        i = 0
#72 g_main_context_dispatch (context=context@entry=0x68b000) at gmain.c:3642
No locals.
#73 0x00007fffeefb3668 in g_main_context_iterate (context=0x68b000, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
    at gmain.c:3713
        max_priority = 120
        timeout = 0
        some_ready = 1
        nfds = <optimized out>
        allocated_nfds = 2
        fds = 0x8b4330
#74 0x00007fffeefb3a6a in g_main_loop_run (loop=0x49ee6c0) at gmain.c:3907
        __PRETTY_FUNCTION__ = "g_main_loop_run"
#75 0x00007ffff09de627 in IA__gtk_main () at gtkmain.c:1257
        tmp_list = 0x0
        functions = 0x0
        init = <optimized out>
        loop = 0x49ee6c0
#76 0x00007ffff653d78a in gnc_ui_start_event_loop () at gnc-gnome-utils.c:608
        id = 1242
#77 0x0000000000405c33 in inner_main (closure=0x0, argc=1, argv=0x7fffffffd808) at gnucash-bin.c:620
        main_mod = 0xcfd200
        fn = 0x12fc7c0 ""
        error = 0x0
#78 0x00007ffff1c2821f in invoke_main_func (body_data=0x7fffffffd6c0) at init.c:367
        closure = 0x7fffffffd6c0
#79 0x00007ffff1c006fa in c_body (d=d@entry=0x7fffffffd660) at continuations.c:349
        data = 0x7fffffffd660
#80 0x00007ffff1c64338 in scm_c_catch (tag=tag@entry=0x104, body=body@entry=0x7ffff1c006f0 <c_body>, 
    body_data=body_data@entry=0x7fffffffd660, handler=handler@entry=0x7ffff1c00710 <c_handler>, 
    handler_data=handler_data@entry=0x7fffffffd660, pre_unwind_handler=pre_unwind_handler@entry=
    0x7ffff1c64930 <scm_handle_by_message_noexit>, pre_unwind_handler_data=pre_unwind_handler_data@entry=0x0) at throw.c:203
        jbr = {buf = {{__jmpbuf = {140737252164048, 2250612906068029882, 140737249691952, 13047104, 13622560, 140737249691952, 
                2250612906078515642, 2250626568852877754}, __mask_was_saved = 0, __saved_mask = {__val = {140737249461836, 0, 14200976, 
                  14172400, 140737249354020, 14172384, 140737252164048, 14173072, 14172416, 140737488344440, 14172416, 13109344, 
                  14172416, 4294967296, 14172432, 13515040}}}}, throw_tag = 0xce3920, retval = 0x0}
        answer = 0x404
        pre_unwind = {handler = 0x7ffff1c64930 <scm_handle_by_message_noexit>, handler_data = 0x0, running = 0, lazy_catch_p = 0}
#81 0x00007ffff1c00c83 in scm_i_with_continuation_barrier (body=body@entry=0x7ffff1c006f0 <c_body>, 
    body_data=body_data@entry=0x7fffffffd660, handler=handler@entry=0x7ffff1c00710 <c_handler>, 
    handler_data=handler_data@entry=0x7fffffffd660, pre_unwind_handler=0x7ffff1c64930 <scm_handle_by_message_noexit>, 
    pre_unwind_handler_data=pre_unwind_handler_data@entry=0x0) at continuations.c:325
        stack_item = 140737249513924
        thread = 0xc71540
        old_controot = 0xc79490
        old_contbase = 0x7fffffffd698
        old_lastframe = 0x0
        result = 0x0
#82 0x00007ffff1c00d10 in scm_c_with_continuation_barrier (func=func@entry=0x7ffff1c28200 <invoke_main_func>, 
    data=data@entry=0x7fffffffd6c0) at continuations.c:367
        c_data = {func = 0x7ffff1c28200 <invoke_main_func>, data = 0x7fffffffd6c0, result = 0x7ffff1c28200 <invoke_main_func>}
#83 0x00007ffff1c628e9 in scm_i_with_guile_and_parent (func=0x7ffff1c28200 <invoke_main_func>, data=0x7fffffffd6c0, 
    parent=<optimized out>) at threads.c:733
        res = <optimized out>
        really_entered = 1
        base_item = 140737326565088
#84 0x00007ffff1c28355 in scm_boot_guile (argc=<optimized out>, argv=<optimized out>, main_func=<optimized out>, closure=<optimized out>)
    at init.c:350
        res = <optimized out>
        c = {main_func = 0x405ac2 <inner_main>, closure = 0x0, argc = 1, argv = 0x7fffffffd808}
#85 0x0000000000406035 in main (argc=1, argv=0x7fffffffd808) at gnucash-bin.c:774
        sys_locale = 0x658c30 ":0"
        __FUNCTION__ = "main"