Ubuntu MATE application menu vanishes shortly after opening every time it is clicked on

Also I see multiple Apport windows informing me about Caja crashes after having opened the application menu a few times.

Backtrace: (not sure if I did this right or how much valuable info is in this)

(gdb) bt -full
#0 blow_expensive_caches (data=0x56140b6fc0b0)
    at /build/mate-desktop-kIYUV3/mate-desktop-1.26.0/libmate-desktop/mate-bg.c:2025
        ent = <optimized out>
        bg = 0x56140b6fc0b0
        list = 0xc4db9a49a7ccef7e
#1 0x00007fbf60f21a7f in g_main_context_dispatch ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#2 0x00007fbf60f7c518 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#3 0x00007fbf60f1f4a0 in g_main_context_iteration ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#4 0x00007fbf6114e0dd in g_application_run ()
   from /lib/x86_64-linux-gnu/libgio-2.0.so.0
No symbol table info available.
#5 0x000056140993d5c5 in main (argc=1, argv=0x7ffd54f64048)
    at ./src/caja-main.c:271
        retval = <optimized out>
        application = 0x56140af73600

I am not experiencing this any longer on the latest Ubuntu MATE Beta release candidate. I had experienced it in the past before reporting this, then it went away and then came back, so I'm not closing this quite yet, but this might be OK (hopefully).

Hmm, nevermind. It's still happening, but it's much more intermittent (when I reported it, it was every single time I opened the menu that it crashed). Now the menu is usable, but every once in a while it vanishes out of nowhere, and I've seen a Caja crash at least once.

This bug has been reported on the Ubuntu ISO testing tracker.

A list of all reports related to this bug can be found here:
https://iso.qa.ubuntu.com/qatracker/reports/bugs/2013138

The plot thickens. On some bootups, everything mostly works except for the menu vanishes every so often. One other bootsup, though, Caja just goes into an endless crash loop. No desktop icons appear, the mouse pointer intermittently switches between normal and a spinning "busy" indicator. The application menu can't be opened for more than a short amount of time, and if you do manage to open a Caja file manager window, it vanishes too.

Going to be attaching full debug info soon.

Full debug info at https://bugs.launchpad.net/ubuntu/+source/caja/+bug/2013392 (yes this is a public bug, everything was done in a clean VM with no personal info)

  if (bg->file_cache) {
    for (list = bg->file_cache; list != NULL; list = list->next) {
      FileCacheEntry *ent = list->data;

      if (ent->type == PIXBUF) {
        file_cache_entry_delete (ent);
        bg->file_cache = g_list_delete_link (bg->file_cache,
                     list);
      }
    }
  }

The code is crashing on the "list->data" dereference. Just like Openbox.

This commit should fix it: https://git.mate-desktop.org/mate-desktop/commit/?id=7b379f54a5b09df007f7e84dabbbc5f8ce9381a9

Marking as Confirmed since there's an upstream commit relating to the crashing code area.

I have verified that this patch works on a VM that was exhibiting this bug quite badly - after installing an update libmate-desktop, the application menu now works normally (no more vanishing that I can tell) and desktop icons are present again.

Patch ready for review.

An errors bucket for this crash can be found at https://errors.ubuntu.com/problem/89a9691556cf1dca3af59c8da900ba58090e1982. There are hundreds of incidents of this.

I uploaded this today.

This bug was fixed in the package mate-desktop - 1.26.0-1ubuntu1

---------------
mate-desktop (1.26.0-1ubuntu1) lunar; urgency=medium

  [ Aaron Rainbolt ]
  * Patch a use-after-free in mate-bg.c. (LP: #2013138)

  [ Brian Murray ]
  * debian/control:
    + Switch dep from libgdk-pixbuf2.0-dev to libgdk-pixbuf-2.0-dev.

 -- Aaron Rainbolt <email address hidden> Thu, 30 Mar 2023 17:41:34 -0500