I manage to reproduce this bug in Fedora 28 with inkscape version: $ inkscape -V Inkscape 0.92.3 (2405546, 2018-03-11) by doing the following: 1. Open inkscape (new file). 2. Add a text field. 3. Type in some text and hit the Enter key. 4. Crash. Running with gdb I get the following trace: (gdb) r Starting program: /usr/bin/inkscape warning: Loadable section ".note.gnu.property" outside of ELF segments warning: Loadable section ".note.gnu.property" outside of ELF segments warning: Loadable section ".note.gnu.property" outside of ELF segments warning: Loadable section ".note.gnu.property" outside of ELF segments [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". warning: Loadable section ".note.gnu.property" outside of ELF segments warning: Loadable section ".note.gnu.property" outside of ELF segments warning: Loadable section ".note.gnu.property" outside of ELF segments warning: Loadable section ".note.gnu.property" outside of ELF segments warning: Loadable section ".note.gnu.property" outside of ELF segments warning: Loadable section ".note.gnu.property" outside of ELF segments warning: Loadable section ".note.gnu.property" outside of ELF segments [New Thread 0x7fffe4c40700 (LWP 5306)] [New Thread 0x7fffe443f700 (LWP 5307)] [New Thread 0x7fffe3c3e700 (LWP 5308)] warning: Loadable section ".note.gnu.property" outside of ELF segments [New Thread 0x7fffd514b700 (LWP 5309)] [New Thread 0x7fffd494a700 (LWP 5310)] /usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = Inkscape::Text::Layout::Character; _Alloc = std::allocator; std::vector<_Tp, _Alloc>::const_reference = const Inkscape::Text::Layout::Character&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed. Thread 1 "inkscape" received signal SIGABRT, Aborted. 0x00007fffedccff4b in raise () from /lib64/libc.so.6 (gdb) where #0 0x00007fffedccff4b in raise () from /lib64/libc.so.6 #1 0x00007fffedcba591 in abort () from /lib64/libc.so.6 #2 0x00007ffff6eb4748 in std::__replacement_assert(char const*, int, char const*, char const*) () from /usr/bin/../lib/inkscape/libinkscape_base.so #3 0x00007ffff75f63d3 in std::vector >::operator[](unsigned long) const () from /usr/bin/../lib/inkscape/libinkscape_base.so #4 0x00007ffff75f090d in Inkscape::Text::Layout::sourceToIterator(void*) const () from /usr/bin/../lib/inkscape/libinkscape_base.so #5 0x00007ffff75b1ea0 in SPText::rebuildLayout() () from /usr/bin/../lib/inkscape/libinkscape_base.so #6 0x00007ffff75b2d67 in SPText::write(Inkscape::XML::Document*, Inkscape::XML::Node*, unsigned int) () from /usr/bin/../lib/inkscape/libinkscape_base.so #7 0x00007ffff7529a05 in sp_te_insert_line(SPItem*, Inkscape::Text::Layout::iterator const&) () from /usr/bin/../lib/inkscape/libinkscape_base.so #8 0x00007ffff7177060 in Inkscape::UI::Tools::TextTool::root_handler(_GdkEvent*) () from /usr/bin/../lib/inkscape/libinkscape_base.so #9 0x00007ffff7179bec in Inkscape::UI::Tools::sp_event_context_virtual_root_handler(Inkscape::UI::Tools::ToolBase*, _GdkEvent*) () from /usr/bin/../lib/inkscape/libinkscape_base.so #10 0x00007ffff745b46d in sp_desktop_root_handler(SPCanvasItem*, _GdkEvent*, SPDesktop*) () from /usr/bin/../lib/inkscape/libinkscape_base.so #11 0x00007ffff6feaefb in sp_marshal_BOOLEAN__POINTER () ---Type to continue, or q to quit--- from /usr/bin/../lib/inkscape/libinkscape_base.so #12 0x00007ffff5c11add in g_closure_invoke () from /lib64/libgobject-2.0.so.0 #13 0x00007ffff5c24eb3 in signal_emit_unlocked_R () from /lib64/libgobject-2.0.so.0 #14 0x00007ffff5c2d653 in g_signal_emit_valist () from /lib64/libgobject-2.0.so.0 #15 0x00007ffff5c2e5d3 in g_signal_emit () from /lib64/libgobject-2.0.so.0 #16 0x00007ffff6f1221e in SPCanvas::emitEvent(_GdkEvent*) () from /usr/bin/../lib/inkscape/libinkscape_base.so #17 0x00007ffff04da9ad in _gtk_marshal_BOOLEAN__BOXED () from /lib64/libgtk-x11-2.0.so.0 #18 0x00007ffff5c119f5 in g_closure_invoke () from /lib64/libgobject-2.0.so.0 #19 0x00007ffff5c246e4 in signal_emit_unlocked_R () from /lib64/libgobject-2.0.so.0 #20 0x00007ffff5c2d653 in g_signal_emit_valist () from /lib64/libgobject-2.0.so.0 #21 0x00007ffff5c2e5d3 in g_signal_emit () from /lib64/libgobject-2.0.so.0 #22 0x00007ffff060e8dc in gtk_widget_event_internal () from /lib64/libgtk-x11-2.0.so.0 #23 0x00007ffff06241d8 in gtk_window_propagate_key_event () from /lib64/libgtk-x11-2.0.so.0 #24 0x00007ffff06271a3 in gtk_window_key_press_event () from /lib64/libgtk-x11-2.0.so.0 ---Type to continue, or q to quit--- #25 0x00007ffff04da9ad in _gtk_marshal_BOOLEAN__BOXED () from /lib64/libgtk-x11-2.0.so.0 #26 0x00007ffff5c11add in g_closure_invoke () from /lib64/libgobject-2.0.so.0 #27 0x00007ffff5c246e4 in signal_emit_unlocked_R () from /lib64/libgobject-2.0.so.0 #28 0x00007ffff5c2d653 in g_signal_emit_valist () from /lib64/libgobject-2.0.so.0 #29 0x00007ffff5c2e5d3 in g_signal_emit () from /lib64/libgobject-2.0.so.0 #30 0x00007ffff060e8dc in gtk_widget_event_internal () from /lib64/libgtk-x11-2.0.so.0 #31 0x00007ffff04d869d in gtk_propagate_event () from /lib64/libgtk-x11-2.0.so.0 #32 0x00007ffff04d89cb in gtk_main_do_event () from /lib64/libgtk-x11-2.0.so.0 #33 0x00007fffefb62f00 in gdk_event_dispatch () from /lib64/libgdk-x11-2.0.so.0 #34 0x00007ffff476c7cd in g_main_context_dispatch () from /lib64/libglib-2.0.so.0 #35 0x00007ffff476cb98 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0 #36 0x00007ffff476cec2 in g_main_loop_run () from /lib64/libglib-2.0.so.0 #37 0x00007ffff04d795f in gtk_main () from /lib64/libgtk-x11-2.0.so.0 #38 0x000055555555eea3 in sp_main_gui(int, char const**) () #39 0x00007fffedcbc1bb in __libc_start_main () from /lib64/libc.so.6 #40 0x000055555555b1ca in _start () I can confirm opening Ben's example file also reproduces the crash for me.