Created attachment 12705 [details]
An image that crashes Cairo

Created attachment 12706 [details]
GDB output

I added this line to fbcompose.c right before the line that caused the SIGFPE:
printf("y1: %d, height: %d\n", y1, pict->pDrawable->height);

Here is the output I got (I installed the modified Cairo to /opt):
david@laptop:~/Desktop$ LD_LIBRARY_PATH=/opt/lib eog image.svg
y1: -29, height: 8
y1: -29, height: 8
y1: -29, height: 8
... Counts up to "y1: 88, height: 8" repeating each "y1" many, many times...
y1: 88, height: 8
y1: 88, height: 8
y1: 88, height: 8
y1: -1, height: 0
Floating point exception (core dumped)
david@laptop:~/Desktop$ 

I guess that means my division by zero guess is correct.

cairo version?

1.4.10

Checking the various paths through to the image surface, we should return early if we attempt to operate on a zero-sized image - so this bug appears fixed and is currently unreproducible.