Comment 12 for bug 131564

It is a bug in the engine. g_free() is only supposed to be used on memory returned from g_malloc(); for nearly all gtk object types, there are type-specific allocator functions which are supposed to be used - and are used in this case where gtk is being asked to return objects of this type. This means that the type-specific deallocator functions must also be used, and the crash is a direct result of not doing so. The fact that the code doesn't crash when G_SLICE=always-malloc is used confirms this.

The fact that multiple theme engines share the same bug is largely beside the point, other than to demonstrate a common lineage of the various theme engines by way of code copy'n'paste.