Here is a reproducible crash on svn revision 11251. My 12-year old found this crash running .43 on FC4. I reproduced the problem on FC5 at the tip of svn, rebuilt inkscape debug and produced a stack trace from the core file.
The crash is caused reliably in the following way. Enter some text. Zoom in on the text, or make it big enough to work with easily. The text I used was "This is some text". Select the text tool. use that tool to select,say, the initial T. Change the size of the text to something else noticeably different, it doesn't matter what. The T changes size appropriately. Then place a gradient on the text string as a whole. Now select, say, the s in 'some' with the text tool. Change the size of that s to any other size. Poof! inkscape dumps core, and vanishes.
Here is the gdb backtrace. It is a bit beyond me at the moment. This has something to do with text, gradients and, from the backtrace, selection and styles. I'm hoping someone can make more sense of the backtrace than I.
(gdb) where #0 0x005ec402 in __kernel_vsyscall () at /usr/lib/gcc/i386-redhat-linux/4.1.0/../../../../include/c++/4.1.0/exception:56 #1 0x00e22159 in raise () at /usr/lib/gcc/i386-redhat-linux/4.1.0/../../../../include/c++/4.1.0/exception:56 #2 0x00e236e3 in abort () at /usr/lib/gcc/i386-redhat-linux/4.1.0/../../../../include/c++/4.1.0/exception:56 #3 0x082d1ca8 in inkscape_segv_handler (signum=11) at inkscape.cpp:375 #4 <signal handler called> #5 0x08648c53 in Inkscape::UI::Widget::SelectedStyle::update (this=0xa74e800) at ui/widget/selected-style.cpp:893 #6 0x086495e1 in ss_selection_changed (data=0xa74e800) at ui/widget/selected-style.cpp:46 #7 0x08649618 in ss_selection_modified (selection=0xa6affc0, flags=11, data=0xa74e800) at ui/widget/selected-style.cpp:52 #8 0x0838d6da in sigc::pointer_functor3<Inkscape::Selection*, unsigned int, void*, void>::operator() (this=0xa7a6110, _A_a1=@0xbfa52be4, _A_a2=@0xbfa52bf4, _A_a3=@0xbfa52af4) at /usr/include/sigc++-2.0/sigc++/functors/ptr_fun.h:185 #9 0x08662e17 in sigc::adaptor_functor<sigc::pointer_functor3<Inkscape::Selection*, unsigned int, void*, void> >::operator()<Inkscape::Selection* const&, unsigned int const&, Inkscape::UI::Widget::SelectedStyle*&> (this=0xa7a610c, _A_arg1=@0xbfa52be4, _A_arg2=@0xbfa52bf4, _A_arg3=@0xa7a6114) at /usr/include/sigc++-2.0/sigc++/adaptors/adaptor_trait.h:123 #10 0x08662e4e in sigc::bind_functor<-1, sigc::pointer_functor3<Inkscape::Selection*, unsigned int, void*, void>, Inkscape::UI::Widget::SelectedStyle*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>::operator()<Inkscape::Selection* const&, unsigned int const&> (this=0xa7a6108, _A_arg1=@0xbfa52be4, _A_arg2=@0xbfa52bf4) at /usr/include/sigc++-2.0/sigc++/adaptors/bind.h:1144 #11 0x08662e78 in sigc::internal::slot_call2<sigc::bind_functor<-1, sigc::pointer_functor3<Inkscape::Selection*, unsigned int, void*, void>, Inkscape::UI::Widget::SelectedStyle*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>, void, Inkscape::Selection*, unsigned int>::call_it (rep=0xa7a60f0, a_1=@0xbfa52be4, a_2=@0xbfa52bf4) at /usr/include/sigc++-2.0/sigc++/functors/slot.h:173 #12 0x082e7d19 in sigc::internal::signal_emit2<void, Inkscape::Selection*, unsigned int, sigc::nil>::emit (impl=0xa7a3ca8, _A_a1=@0xbfa52be4, _A_a2=@0xbfa52bf4) at /usr/include/sigc++-2.0/sigc++/signal.h:832 #13 0x082e7de2 in sigc::signal2<void, Inkscape::Selection*, unsigned int, sigc::nil>::emit (this=0xa6afff0, _A_a1=@0xbfa52be4, _A_a2=@0xbfa52bf4) at /usr/include/sigc++-2.0/sigc++/signal.h:1924 #14 0x082e661a in Inkscape::Selection::_emitModified (this=0xa6affc0, flags=11) at selection.cpp:93 #15 0x082e6651 in Inkscape::Selection::_emit_modified (selection=0xa6affc0) at selection.cpp:85 ---Type <return> to continue, or q <return> to quit--- #16 0x00d8b6e1 in g_list_remove_link () at /usr/lib/gcc/i386-redhat-linux/4.1.0/../../../../include/c++/4.1.0/exception:56 #17 0x00d8d09d in g_main_context_dispatch () at /usr/lib/gcc/i386-redhat-linux/4.1.0/../../../../include/c++/4.1.0/exception:56 #18 0x00d9032f in g_main_context_check () at /usr/lib/gcc/i386-redhat-linux/4.1.0/../../../../include/c++/4.1.0/exception:56 #19 0x00d906d9 in g_main_loop_run () at /usr/lib/gcc/i386-redhat-linux/4.1.0/../../../../include/c++/4.1.0/exception:56 #20 0x03b39a6b in gtk_dialog_run () at /usr/lib/gcc/i386-redhat-linux/4.1.0/../../../../include/c++/4.1.0/exception:56 #21 0x082d25ef in inkscape_segv_handler (signum=11) at inkscape.cpp:525 #22 <signal handler called> #23 0x08648c53 in Inkscape::UI::Widget::SelectedStyle::update (this=0xa74e800) at ui/widget/selected-style.cpp:893 #24 0x086495e1 in ss_selection_changed (data=0xa74e800) at ui/widget/selected-style.cpp:46 #25 0x086495fd in ss_subselection_changed (dragger=0xa659a00, data=0xa74e800) at ui/widget/selected-style.cpp:58 #26 0x084f9f96 in sigc::pointer_functor2<void*, void*, void>::operator() ( this=0xa7a61a8, _A_a1=@0xbfa538c4, _A_a2=@0xbfa53804) at /usr/include/sigc++-2.0/sigc++/functors/ptr_fun.h:147 #27 0x08662ea4 in sigc::adaptor_functor<sigc::pointer_functor2<void*, void*, void> >::operator()<void* const&, Inkscape::UI::Widget::SelectedStyle*&> ( this=0xa7a61a4, _A_arg1=@0xbfa538c4, _A_arg2=@0xa7a61ac) at /usr/include/sigc++-2.0/sigc++/adaptors/adaptor_trait.h:103 #28 0x08662ed3 in sigc::bind_functor<-1, sigc::pointer_functor2<void*, void*, void>, Inkscape::UI::Widget::SelectedStyle*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>::operator()<void* const&> (this=0xa7a61a0, _A_arg1=@0xbfa538c4) at /usr/include/sigc++-2.0/sigc++/adaptors/bind.h:1122 #29 0x08662ef7 in sigc::internal::slot_call1<sigc::bind_functor<-1, sigc::pointer_functor2<void*, void*, void>, Inkscape::UI::Widget::SelectedStyle*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>, void, void*>::call_it (rep=0xa7a6188, a_1=@0xbfa538c4) at /usr/include/sigc++-2.0/sigc++/functors/slot.h:137 #30 0x0837e5ae in sigc::internal::signal_emit1<void, void*, sigc::nil>::emit ( impl=0xa7a6158, _A_a1=@0xbfa538c4) at /usr/include/sigc++-2.0/sigc++/signal.h:686 #31 0x0837e66f in sigc::signal1<void, void*, sigc::nil>::emit (this=0xa6aef94, _A_a1=@0xbfa538c4) at /usr/include/sigc++-2.0/sigc++/signal.h:1812 #32 0x08377605 in SPDesktop::emitToolSubselectionChanged (this=0xa6aee00, data=0xa659a00) at desktop.cpp:1017 ......