Version:           2.2 Beta 1 (trunk) (using KDE 4.3.4)
Compiler:          gcc 4.4.3-1 
OS:                Linux
Installed from:    Compiled From Sources

-----------Possibly interesting system specs---------
2 GB of RAM.
Intel Core Duo 1,66 Ghz processor.
Using Wacom Intuos3.


--------------BACKTRACES--------------------
A large collection of backtraces with attached console Q_ASSERT were collected.
The following is one of all those backtraces, the console output Q_ASSERT was
always the same in all bugs (cmd == 0 in kis_painter.cc, line 159):

CONSOLE OUTPUT:
(uninteresting filler removed)
SSERT: "cmd == 0" in file /KOFFICE/koffice/krita/image/kis_painter.cc, line 159
KCrash: Application 'krita' crashing...
sock_file=/home/kde4/.kde/socket-trizado/kdeinit4__0
kdeinit4: preparing to launch /usr/lib/kde4/libexec/drkonqi
[9]   Exit 253                krita


DEBUGGER BACKTRACE:
Application: Krita (krita), signal: Aborted
[Current thread is 1 (Thread 0x7fc16932b770 (LWP 29397))]

Thread 4 (Thread 0x7fc15875e910 (LWP 29398)):
#0  pthread_cond_wait@@GLIBC_2.3.2 () at
../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:261
#1  0x00007fc168b73499 in QWaitCondition::wait(QMutex*, unsigned long) () from
/usr/lib/libQtCore.so.4
#2  0x00007fc168b6f340 in QSemaphore::acquire(int) () from
/usr/lib/libQtCore.so.4
#3  0x00007fc1682faee6 in KisTileDataPooler::waitForWork (this=0x7fc16865b080)
at /KOFFICE/koffice/krita/image/tiles3/kis_tile_data_pooler.cc:133
#4  0x00007fc1682fb008 in KisTileDataPooler::run (this=0x7fc16865b080) at
/KOFFICE/koffice/krita/image/tiles3/kis_tile_data_pooler.cc:162
#5  0x00007fc168b724a5 in ?? () from /usr/lib/libQtCore.so.4
#6  0x00007fc160f7073a in start_thread (arg=<value optimized out>) at
pthread_create.c:300
#7  0x00007fc161b3a69d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#8  0x0000000000000000 in ?? ()

Thread 3 (Thread 0x7fc1425dc910 (LWP 29400)):
#0  0xffffffffff60012d in ?? ()
#1  0x00007fc16936d532 in ?? ()
#2  0x00007fc16144fe5f in *__GI_clock_gettime (clock_id=1113439952,
tp=0x7fc1425dbed0) at ../sysdeps/unix/clock_gettime.c:100
#3  0x00007fc168c820fd in ?? () from /usr/lib/libQtCore.so.4
#4  0x00007fc168c822e1 in ?? () from /usr/lib/libQtCore.so.4
#5  0x00007fc168c82485 in ?? () from /usr/lib/libQtCore.so.4
#6  0x00007fc168c84487 in
QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
from /usr/lib/libQtCore.so.4
#7  0x00007fc168c56562 in
QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from
/usr/lib/libQtCore.so.4
#8  0x00007fc168c56934 in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from
/usr/lib/libQtCore.so.4
#9  0x00007fc168b6f5a8 in QThread::exec() () from /usr/lib/libQtCore.so.4
#10 0x00007fc168b724a5 in ?? () from /usr/lib/libQtCore.so.4
#11 0x00007fc160f7073a in start_thread (arg=<value optimized out>) at
pthread_create.c:300
#12 0x00007fc161b3a69d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#13 0x0000000000000000 in ?? ()

Thread 2 (Thread 0x7fc1415da910 (LWP 29585)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at
../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:220
#1  0x00007fc168b73477 in QWaitCondition::wait(QMutex*, unsigned long) () from
/usr/lib/libQtCore.so.4
#2  0x00007fc168b692d1 in ?? () from /usr/lib/libQtCore.so.4
#3  0x00007fc168b724a5 in ?? () from /usr/lib/libQtCore.so.4
#4  0x00007fc160f7073a in start_thread (arg=<value optimized out>) at
pthread_create.c:300
#5  0x00007fc161b3a69d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#6  0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7fc16932b770 (LWP 29397)):
[KCrash Handler]
#5  0x00007fc161aa0f45 in *__GI_raise (sig=<value optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
#6  0x00007fc161aa3d80 in *__GI_abort () at abort.c:88
#7  0x00007fc168b6a735 in qt_message_output(QtMsgType, char const*) () from
/usr/lib/libQtCore.so.4
#8  0x00007fc168b6a87b in qFatal(char const*, ...) () from
/usr/lib/libQtCore.so.4
#9  0x00007fc168315759 in ~KisPainter (this=0x7902160, __in_chrg=<value
optimized out>) at /KOFFICE/koffice/krita/image/kis_painter.cc:159
#10 0x00007fc168819ad3 in KisToolFreehand::initPaint (this=0x1641d30) at
/KOFFICE/koffice/krita/ui/tool/kis_tool_freehand.cc:365
#11 0x00007fc14a3d3aeb in KisToolBrush::initPaint (this=0x72d5, e=0x72d5) at
/KOFFICE/koffice/krita/plugins/tools/defaulttools/kis_tool_brush.cc:88
#12 0x00007fc16881b1f2 in KisToolFreehand::mousePressEvent (this=0x1641d30,
e=0x7fffffff9fd0) at /KOFFICE/koffice/krita/ui/tool/kis_tool_freehand.cc:176
#13 0x00007fc1660371c4 in KoToolProxy::tabletEvent (this=0x7fc150d8e1f0,
event=0x7fffffffabc0, point=...) at
/KOFFICE/koffice/libs/flake/KoToolProxy.cpp:151
#14 0x00007fc168722bc0 in KisCanvasWidgetBase::processTabletEvent
(this=0x7fc150d6fad8, e=0x7fffffffabc0) at
/KOFFICE/koffice/krita/ui/canvas/kis_canvas_widget_base.cpp:359
#15 0x00007fc16279709f in QWidget::event(QEvent*) () from
/usr/lib/libQtGui.so.4
#16 0x00007fc16274701d in QApplicationPrivate::notify_helper(QObject*, QEvent*)
() from /usr/lib/libQtGui.so.4
#17 0x00007fc16274f3f3 in QApplication::notify(QObject*, QEvent*) () from
/usr/lib/libQtGui.so.4
#18 0x00007fc164261de6 in KApplication::notify(QObject*, QEvent*) () from
/usr/lib/libkdeui.so.5
#19 0x00007fc168c57c9c in QCoreApplication::notifyInternal(QObject*, QEvent*)
() from /usr/lib/libQtCore.so.4
#20 0x00007fc1627a7d25 in ?? () from /usr/lib/libQtGui.so.4
#21 0x00007fc1627b6a57 in QApplication::x11ProcessEvent(_XEvent*) () from
/usr/lib/libQtGui.so.4
#22 0x00007fc1627df0f2 in ?? () from /usr/lib/libQtGui.so.4
#23 0x00007fc168c56562 in
QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from
/usr/lib/libQtCore.so.4
#24 0x00007fc168c56934 in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from
/usr/lib/libQtCore.so.4
#25 0x00007fc168c58ba4 in QCoreApplication::exec() () from
/usr/lib/libQtCore.so.4
#26 0x00007fc168f5068a in kdemain (argc=<value optimized out>, argv=<value
optimized out>) at /KOFFICE/koffice/krita/main.cc:49
#27 0x00007fc161a8dabd in __libc_start_main (main=<value optimized out>,
argc=<value optimized out>, ubp_av=<value optimized out>, init=<value optimized
out>, fini=<value optimized out>, 
    rtld_fini=<value optimized out>, stack_end=0x7fffffffc8c8) at
libc-start.c:222
#28 0x0000000000400859 in _start ()



-------------HOW TO REPRODUCE--------------

The first instance of the bug was observed when editing a 640x480 image with
~10 or so layers. Steps to reproduce the bug consistently were to pick a brush
and tap the stylus repeatedly near the border of the canvas trying to make
brush strokes that are born from or to outside the canvas. The resulting crash
was nearly instantaneous.
(The discovery was, as usually is, an accident: the area causing the crash was
a part of the drawing close to the upper border that was being heavily edited,
always causing the crash).

Steps to reproduce the crash in a more minimal environment are to create a new
image, and with the stylus make many painting strokes coming from the upper
side of the canvas to the outside, repeated times (attempting to reproduce this
in other sides of the canvas consistently failed).

Attempts to reproduce this crash with a mouse have consistently failed, with
all kinds of actions rearranged, adding layers, size to the image, everything.
In fact, a new crash was discoevered when doing this (possible future bug
report), but this particular crash was never reproduced with the mouse.


---------EXPECTED BEHAVIOR-----------

No crashing, it tends to kill artistic inspiration.