I have 11679 as branch lp988601, is the problem patch in or out of that version? setAttribute() is still causing problems, so I am guessing no. But I could not apply the patch from (5) successfully: patch -p0 2 before using strncmp, which spammed the valgrind output with 40 something invalid reads. It should be: int l = strlen(value_unquoted); if (l>2 && (!strncmp(&value_unquoted[l-2], "em", 2) || !strncmp(&value_unquoted[l-2], "ex", 2) )) { units = g_strndup(&value_unquoted[l-2], 2); value_unquoted = g_strndup(value_unquoted, l-2); } Also, please have mercy and don't use "l" for a variable, it is nearly indistinguishable from "1", especially if your eyes are as bad as mine. 2. (many) leak(s) at line 343 dst->mergeFrom(src, ""); here is one ==5076== 160 (128 direct, 32 indirect) bytes in 8 blocks are definitely lost in loss record 51,144 of 58,146 ==5076== at 0x402BE68: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==5076== by 0x834A9B2: Inkscape::XML::SimpleNode::setAttribute(char const*, char const*, bool) (gc-core.h:74) ==5076== by 0x8347CAD: Inkscape::XML::SimpleNode::mergeFrom(Inkscape::XML::Node const*, char const*) (simple-node.cpp:660) ==5076== by 0x833D814: sp_repr_css_merge(SPCSSAttr*, SPCSSAttr*) (repr-css.cpp:343) ==5076== by 0x8B08327: ??? 3. 1 leak at 351 (6200 bytes in the test run) guchar *const str_value_unsigned = cr_term_to_string(decl->value); when called from 410 sp_repr_css_merge_from_decl(css, decl_list); ==5076== 6,200 bytes in 25 blocks are possibly lost in loss record 57,124 of 58,146 ==5076== at 0x402A420: memalign (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==5076== by 0x402A4DE: posix_memalign (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==5076== by 0x52FF2E1: ??? (in /lib/i386-linux-gnu/libglib-2.0.so.0.3200.3) ==5076== by 0x534B73F: g_slice_alloc (in /lib/i386-linux-gnu/libglib-2.0.so.0.3200.3) ==5076== by 0x534EEE9: g_string_sized_new (in /lib/i386-linux-gnu/libglib-2.0.so.0.3200.3) ==5076== by 0x534F526: g_string_new (in /lib/i386-linux-gnu/libglib-2.0.so.0.3200.3) ==5076== by 0x86CE81E: cr_term_to_string (cr-term.c:287) ==5076== by 0x833DD09: _ZL27sp_repr_css_merge_from_declP9SPCSSAttrPK14_CRDeclaration.isra.27 (repr-css.cpp:351) ==5076== by 0x833E77B: sp_repr_css_attr_add_from_string(SPCSSAttr*, char const*) (repr-css.cpp:410) ==5076== by 0x818C837: sp_css_attr_from_style(SPStyle const*, unsigned int) (style.cpp:4516) ==5076== by 0x86A607C: MarkerComboBox::create_marker_image(unsigned int, char const*, SPDocument*, Inkscape::Drawing&, unsigned int) (stroke-marker-selector.cpp:493) ==5076== by 0x86A6CF2: MarkerComboBox::add_markers(_GSList*, SPDocument*, int) (stroke-marker-selector.cpp:404) 5. a bunch of leaks at 43 : SimpleNode(g_quark_from_static_string("css"), doc) {} This last one drops a lot of memory: ==5076== 25,239 (400 direct, 24,839 indirect) bytes in 25 blocks are definitely lost in loss record 57,757 of 58,146 ==5076== at 0x402BE68: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==5076== by 0x865D205: Inkscape::XML::CompositeNodeObserver::add(Inkscape::XML::NodeObserver&) (gc-core.h:74) ==5076== by 0x8348521: Inkscape::XML::SimpleNode::SimpleNode(int, Inkscape::XML::Document*) (simple-node.cpp:178) ==5076== by 0x833D022: sp_repr_css_attr_new() (repr-css.cpp:43) ==5076== by 0x818C827: sp_css_attr_from_style(SPStyle const*, unsigned int) (style.cpp:4515) ==5076== by 0x86A607C: MarkerComboBox::create_marker_image(unsigned int, char const*, SPDocument*, Inkscape::Drawing&, unsigned int) (stroke-marker-selector.cpp:493) ==5076== by 0x86A6CF2: MarkerComboBox::add_markers(_GSList*, SPDocument*, int) (stroke-marker-selector.cpp:404) ==5076== by 0x86A71F6: MarkerComboBox::sp_marker_list_from_doc(SPDocument*, int) (stroke-marker-selector.cpp:318) ==5076== by 0x86A7834: MarkerComboBox::init_combo() (stroke-marker-selector.cpp:193) ==5076== by 0x86A8285: MarkerComboBox::MarkerComboBox(char const*, int) (stroke-marker-selector.cpp:74) ==5076== by 0xA387CFF: ???