Created attachment 342381 [details]
A backtrace from gdb attached to valgrind running gnome-calendar as described in comment #0

Steps to reproduce:
1. open gnome-calendar
2. close gnome-calendar

What happens:
crashes quite often with segmentation violation. If it doesn't crash, it gives warnings like these:

gtk_container_remove: assertion 'GTK_IS_WIDGET (widget)' failed

What should happen:
No crash

Affected version:
gnome-calendar-3.22.2-1.fc25.x86_64
gtk3-3.22.5-1.fc25.x86_64
glib2-2.50.2-1.fc25.x86_64

Steps to reproduce backtrace:
1. run valgrind:
$ G_DEBUG=fatal-warnings G_ENABLE=DIAGNOSTICS=true valgrind --vgdb=full --vgdb-error=0 /usr/bin/gnome-calendar
2. start gdb:
$ gdb
3. attach gdb to valgrind:
(gdb) target remote | vgdb
4. continue in gdb
(gdb) c
5. wait for gnome-calendar to show up
6. close gnome-calendar window

Valgrind output:

==20574== Invalid read of size 8
==20574==    at 0x639F8C0: gtk_widget_get_scale_factor (gtkwidget.c:10878)
==20574==    by 0x61BA648: gtk_css_widget_node_get_style_provider (gtkcsswidgetnode.c:250)
==20574==    by 0x61A02BB: gtk_css_node_get_style_provider_or_null (gtkcssnode.c:121)
==20574==    by 0x61A02BB: gtk_css_node_invalidate_style_provider (gtkcssnode.c:1316)
==20574==    by 0x8AE33E4: g_closure_invoke (gclosure.c:804)
==20574==    by 0x8AF5431: signal_emit_unlocked_R (gsignal.c:3635)
==20574==    by 0x8AFE05E: g_signal_emit_valist (gsignal.c:3391)
==20574==    by 0x8AFE43E: g_signal_emit (gsignal.c:3447)
==20574==    by 0x126CCC: gcal_application_finalize (gcal-application.c:212)
==20574==    by 0x8AE8116: g_object_unref (gobject.c:3185)
==20574==    by 0x11F159: main (main.c:44)
==20574==  Address 0x247b5258 is 824 bytes inside a block of size 864 free'd
==20574==    at 0x4C2ED4A: free (vg_replace_malloc.c:530)
==20574==    by 0x8D756BD: g_free (gmem.c:189)
==20574==    by 0x8D8E20F: g_slice_free1 (gslice.c:1136)
==20574==    by 0x8B06B01: g_type_free_instance (gtype.c:1937)
==20574==    by 0x61300ED: gtk_application_window_dispose (gtkapplicationwindow.c:801)
==20574==    by 0x8AE9AE8: g_object_run_dispose (gobject.c:1084)
==20574==    by 0x624D59D: gtk_main_do_event (gtkmain.c:1806)
==20574==    by 0x63B1870: send_delete_event (gtkwindow.c:1321)
==20574==    by 0x6959D47: gdk_threads_dispatch (gdk.c:743)
==20574==    by 0x8D6C8E6: g_idle_dispatch (gmain.c:5545)
==20574==    by 0x8D6FE41: g_main_dispatch (gmain.c:3203)
==20574==    by 0x8D6FE41: g_main_context_dispatch (gmain.c:3856)
==20574==    by 0x8D701BF: g_main_context_iterate.isra.24 (gmain.c:3929)
==20574==  Block was alloc'd at
==20574==    at 0x4C2DB9D: malloc (vg_replace_malloc.c:299)
==20574==    by 0x8D755A8: g_malloc (gmem.c:94)
==20574==    by 0x8D8DB02: g_slice_alloc (gslice.c:1025)
==20574==    by 0x8D8E12D: g_slice_alloc0 (gslice.c:1051)
==20574==    by 0x8B06839: g_type_create_instance (gtype.c:1839)
==20574==    by 0x8AE869A: g_object_new_internal (gobject.c:1783)
==20574==    by 0x8AEA0AC: g_object_newv (gobject.c:1930)
==20574==    by 0x6144D79: _gtk_builder_construct (gtkbuilder.c:717)
==20574==    by 0x61463D4: builder_construct.isra.5 (gtkbuilderparser.c:139)
==20574==    by 0x6146E10: parse_child (gtkbuilderparser.c:522)
==20574==    by 0x6146E10: start_element (gtkbuilderparser.c:970)
==20574==    by 0x8D73412: emit_start_element (gmarkup.c:1042)
==20574==    by 0x8D744FA: g_markup_parse_context_parse (gmarkup.c:1389)

Truncated backtrace:

+ Trace 237014

(full backtrace attached)

Additional info:
This bug is probably the cause for downstream bugs like these:
https://bugzilla.redhat.com/show_bug.cgi?id=1385383
https://bugzilla.redhat.com/show_bug.cgi?id=1408207