This is a forwarded bug from Inkscape bugtracker, please follow-up at
It looks like some stack corruption is going on within composite_boxes(), which triggers segfaults in Inkscape if built with stack protector enabled (as in Ubuntu).
#4 0x00007ffff0673260 in __stack_chk_fail ()
No symbol table info available.
#5 0x00007ffff16a3172 in composite_boxes (extents=0x7fffffffd510,
boxes=<optimized out>, compositor=<optimized out>)
For the full backtrace and the original bug procedure, see the report on launchpad.
A reduced crashing input-file is available there too.
I was not able to reproduce that on master. Judging from the trace, I believe the fix is
Author: Seongwon Cho <email@example.com>
Date: Wed Feb 29 18:59:34 2012 +0900
mono-scan-convertor: Include space for the closing span
When estimating the maximum number of spans required for a particular
width, we need to include a closing span.
Reviewed-by: Zhigang Gong <firstname.lastname@example.org>
Signed-off-by: Chris Wilson <email@example.com>