Comment 18 for bug 1767518

I've got a very similar problem:

$ rpm -q inkscape
inkscape-0.92.3-1.fc28.x86_64

/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = Inkscape::Text::Layout::Character; _Alloc = std::allocator<Inkscape::Text::Layout::Character>; std::vector<_Tp, _Alloc>::const_reference = const Inkscape::Text::Layout::Character&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.

Thread 1 "inkscape" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50 return ret;
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x00007fffedcbe591 in __GI_abort () at abort.c:79
#2 0x00007ffff6eb4748 in std::__replacement_assert(char const*, int, char const*, char const*) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#3 0x00007ffff75f63d3 in std::vector<Inkscape::Text::Layout::Character, std::allocator<Inkscape::Text::Layout::Character> >::operator[](unsigned long) const ()
   from /usr/bin/../lib/inkscape/libinkscape_base.so
#4 0x00007ffff75f090d in Inkscape::Text::Layout::sourceToIterator(void*) const () from /usr/bin/../lib/inkscape/libinkscape_base.so
#5 0x00007ffff75b1ea0 in SPText::rebuildLayout() () from /usr/bin/../lib/inkscape/libinkscape_base.so
#6 0x00007ffff75b2b65 in SPText::update(SPCtx*, unsigned int) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#7 0x00007ffff758fd48 in SPObject::updateDisplay(SPCtx*, unsigned int) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#8 0x00007ffff756b165 in SPGroup::update(SPCtx*, unsigned int) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#9 0x00007ffff758fd48 in SPObject::updateDisplay(SPCtx*, unsigned int) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#10 0x00007ffff756b165 in SPGroup::update(SPCtx*, unsigned int) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#11 0x00007ffff75a011c in SPRoot::update(SPCtx*, unsigned int) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#12 0x00007ffff758fd48 in SPObject::updateDisplay(SPCtx*, unsigned int) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#13 0x00007ffff7479e62 in SPDocument::_updateDocument() () from /usr/bin/../lib/inkscape/libinkscape_base.so
#14 0x00007ffff7479e9d in sp_document_idle_handler(void*) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#15 0x00007ffff476d0eb in g_idle_dispatch () from /lib64/libglib-2.0.so.0
#16 0x00007ffff47707cd in g_main_context_dispatch () from /lib64/libglib-2.0.so.0
#17 0x00007ffff4770b98 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0
#18 0x00007ffff4770ec2 in g_main_loop_run () from /lib64/libglib-2.0.so.0
#19 0x00007ffff0457703 in gtk_dialog_run () from /lib64/libgtk-x11-2.0.so.0
#20 0x00007ffff71e1560 in Inkscape::UI::Dialog::FileOpenDialogImplGtk::show() () from /usr/bin/../lib/inkscape/libinkscape_base.so
#21 0x00007ffff748d15b in sp_file_open_dialog(Gtk::Window&, void*, void*) () from /usr/bin/../lib/inkscape/libinkscape_base.so
---Type <return> to continue, or q <return> to quit---
#22 0x00007ffff6fd765a in sp_action_perform(SPAction*, void*) () from /usr/bin/../lib/inkscape/libinkscape_base.so
#23 0x00007ffff5c11add in g_closure_invoke () from /lib64/libgobject-2.0.so.0
#24 0x00007ffff5c24eb3 in signal_emit_unlocked_R () from /lib64/libgobject-2.0.so.0
#25 0x00007ffff5c2dfda in g_signal_emit_valist () from /lib64/libgobject-2.0.so.0
#26 0x00007ffff5c2e5d3 in g_signal_emit () from /lib64/libgobject-2.0.so.0
#27 0x00007ffff0611432 in gtk_widget_activate () from /lib64/libgtk-x11-2.0.so.0
#28 0x00007ffff04f47bd in gtk_menu_shell_activate_item () from /lib64/libgtk-x11-2.0.so.0
#29 0x00007ffff04f4ae8 in gtk_menu_shell_button_release () from /lib64/libgtk-x11-2.0.so.0
#30 0x00007ffff04de9ad in _gtk_marshal_BOOLEAN__BOXED () from /lib64/libgtk-x11-2.0.so.0
#31 0x00007ffff5c11add in g_closure_invoke () from /lib64/libgobject-2.0.so.0
#32 0x00007ffff5c246e4 in signal_emit_unlocked_R () from /lib64/libgobject-2.0.so.0
#33 0x00007ffff5c2d653 in g_signal_emit_valist () from /lib64/libgobject-2.0.so.0
#34 0x00007ffff5c2e5d3 in g_signal_emit () from /lib64/libgobject-2.0.so.0
#35 0x00007ffff06128dc in gtk_widget_event_internal () from /lib64/libgtk-x11-2.0.so.0
#36 0x00007ffff04dc5cc in gtk_propagate_event () from /lib64/libgtk-x11-2.0.so.0
#37 0x00007ffff04dc9cb in gtk_main_do_event () from /lib64/libgtk-x11-2.0.so.0
#38 0x00007fffefb66f00 in gdk_event_dispatch () from /lib64/libgdk-x11-2.0.so.0
#39 0x00007ffff47707cd in g_main_context_dispatch () from /lib64/libglib-2.0.so.0
#40 0x00007ffff4770b98 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0
#41 0x00007ffff4770ec2 in g_main_loop_run () from /lib64/libglib-2.0.so.0
#42 0x00007ffff04db95f in gtk_main () from /lib64/libgtk-x11-2.0.so.0
#43 0x000055555555eea3 in sp_main_gui(int, char const**) ()
#44 0x00007fffedcc01bb in __libc_start_main (main=0x55555555ac70 <main>, argc=1, argv=0x7fffffffd4d8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffd4c8)
    at ../csu/libc-start.c:308
#45 0x000055555555b1ca in _start ()

This one might be easier to reproduce. It crashes as soon as I try to open the attached file.