which url ? 
(I've been trying to reproduce without success so far)

Also, can you provide a more detailed backtrace ? Or is it all there is ?

The associated bug URL :
https://bugs.launchpad.net/inkscape/+bug/977938

With oxygen-gtk2 1.2.5 the bugtrace I pasted is all I get for the crash.
Here is the complete GDB output :

Starting program: /usr/bin/inkscape 
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/libthread_db.so.1".
Traceback (most recent call last):
  File "/usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.3200.3-gdb.py", line 9, in <module>
    from gobject import register
  File "/usr/share/glib-2.0/gdb/gobject.py", line 3, in <module>
    import gdb.backtrace
ImportError: No module named backtrace
gtkspell error: enchant error for language: en_US.UTF-8

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff103c7f8 in __dynamic_cast () from /usr/lib/libstdc++.so.6
(gdb)

ok. So ... attached url provide a more detailed backtrace. copying there for book keeping.

Crash occurs in animation code. Somehow some widgets are asked to be repainted after they are destroyed (by pressing the cancel button). This should not happen, but ...

That also explains why the crash does not occur every time. There must be a race condition between receiving the "destroyed" signal, and running the animation. Will investigate.

In the meanwhile you can disable oxygen animations, if needed. The crash should not occur any more.

The backtrace:
#0 0x00007ffff1835678 in __dynamic_cast () from /usr/lib/libstdc++.so.6
#1 0x00007ffff6d4249f in Gtk::Container_Class::forall_vfunc_callback(_GtkContainer*, int, void (*)(_GtkWidget*, void*), void*) () from /usr/lib/libgtkmm-2.4.so.1
#2 0x00007ffff5cefec5 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#3 0x00007ffff5cf205b in gtk_widget_queue_draw () from /usr/lib/libgtk-x11-2.0.so.0
#4 0x00007fffea966860 in Oxygen::WidgetStateData::delayedUpdate(void*) ()
   from /usr/lib/gtk-2.0/2.10.0/engines/liboxygen-gtk.so
#5 0x00007fffea960eed in Oxygen::TimeLine::update() () from /usr/lib/gtk-2.0/2.10.0/engines/liboxygen-gtk.so
#6 0x00007fffea961609 in Oxygen::TimeLineServer::update(void*) ()
   from /usr/lib/gtk-2.0/2.10.0/engines/liboxygen-gtk.so
#7 0x00007ffff1b2309b in ?? () from /usr/lib/libglib-2.0.so.0
#8 0x00007ffff1b218bd in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#9 0x00007ffff1b220b8 in ?? () from /usr/lib/libglib-2.0.so.0
#10 0x00007ffff1b225f2 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#11 0x00007ffff5bce637 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#12 0x00000000006a2fdb in sp_main_gui(int, char const**) ()
#13 0x00007ffff1164455 in __libc_start_main () from /lib/libc.so.6
#14 0x00000000006a0601 in _start ()

question: what is the gtk version you are using ? 
(I have 2.24.10)

Alright.

Yes I confirm, the bug does not occur if I disable Oxygen animations.
Thanks for your help.

Oh and by the way, thanks for oxygen-gtk in general, you're doing a great job making GTK apps look nice :-)

I'm using gtk2 2.24.10-3.
(gtk-engines 2.21.0-1, oxygen-gtk2 1.2.5-1)

@Daniel,
Since I am not able to reproduce the bug (trust me, I've tried create new layer/cancel quite a number of time already), how confident are you with
- compiling oxygen-gtk from source ?
- try a patch that I would post here ? (and which I would commit if it works)

Thanks in advance,

Hugo

Quite confident :-)

I was actually just about to test the whole thing with the latest git oxygen-gtk2 source, which I haven't tested yet.
So yeah, post the patch, I'll test it.
Which version of oxygen-gtk do you want me to test ?

It seems I've reproduced the crash with 1.2 branch, but haven't got any crash with master. Also, have to check if the backtrace is the same.

Yes, the backtrace is the same. I'll try doing git-bisect (though direct good-bad between 1.2 and master doesn't work, will have to do it reversed)

Ook, interesting... ?
I tested on my two computers, both running Archlinux 64bits, both KDE 4.8.4, one with dark oxygen theme - the crash happens.

Arch is supposedly as vanilla as possible...
I'm comiling the git version of oxygen-gtk as I write to test it.

Well the latest git version of oxygen-gtk2 does change the behaviour of the bug (at least with the bazaar version of Inkscape, didn't try the stable version).

It seems even less predictable.
It did happen after the first try, as well as after the ~50 time.
In some cases I was NOT able to reproduce the bug...

OK, you're right. In GDB I do reproduce this even with master.

I've added some log to oxygen-gtk and installed some else dbg symbols, and here's the output (notice that all the is_widget are true (checks for GTK_IS_WIDGET(data._target))):

Oxygen::WidgetStateData::updateState - 0x7c8f010 (gtkmm__GtkButton) state: 1 rect: ( 0,0,-1,-1) opacity: 0 is_widget? true
Oxygen::WidgetStateData::updateState - 0x581b3d0 (gtkmm__GtkEntry) state: 0 rect: ( 0,0,-1,-1) opacity: 0.4 is_widget? true
Oxygen::WidgetStateData::updateState - 0x7c8f010 (gtkmm__GtkButton) state: 0 rect: ( 0,0,-1,-1) opacity: 0 is_widget? true
Oxygen::WidgetStateData::updateState - 0x7c8f010 (gtkmm__GtkButton) state: 1 rect: ( 0,0,-1,-1) opacity: 0.5 is_widget? true
Oxygen::WidgetStateData::updateState - 0x581b3d0 (gtkmm__GtkEntry) state: 0 rect: ( 0,0,-1,-1) opacity: 0.3 is_widget? true
Oxygen::WidgetStateData::updateState - 0x581b3d0 (gtkmm__GtkEntry) state: 0 rect: ( 0,0,-1,-1) opacity: 0 is_widget? true
Oxygen::WidgetStateData::updateState - 0x7c8f010 (gtkmm__GtkButton) state: 1 rect: ( 0,0,-1,-1) opacity: 1 is_widget? true

Program received signal SIGSEGV, Segmentation fault.
__cxxabiv1::__dynamic_cast (src_ptr=0x7d54a70, src_type=0x125e820, dst_type=0x125eee0, src2dst=-1) at ../../../../src/libstdc++-v3/libsupc++/dyncast.cc:57
57      ../../../../src/libstdc++-v3/libsupc++/dyncast.cc: No such file or directory.
(gdb) bt
#0  __cxxabiv1::__dynamic_cast (src_ptr=0x7d54a70, src_type=0x125e820, dst_type=0x125eee0, src2dst=-1) at ../../../../src/libstdc++-v3/libsupc++/dyncast.cc:57
#1  0x00007ffff7a1bb4f in Gtk::Container_Class::forall_vfunc_callback (self=0x7c8f010, include_internals=1, callback=0x7ffff5eabd70 <widget_add_child_draw_rectangle>, callback_data=0x7fffffffda50)
    at container.cc:450
#2  0x00007ffff5eabca5 in gtk_widget_get_draw_rectangle (rect=0x7fffffffda50, widget=0x7c8f010) at /build/buildd/gtk+2.0-2.24.10/gtk/gtkwidget.c:3729
#3  gtk_widget_get_draw_rectangle (widget=0x7c8f010, rect=0x7fffffffda50) at /build/buildd/gtk+2.0-2.24.10/gtk/gtkwidget.c:3706
#4  0x00007ffff5eade3b in IA__gtk_widget_queue_draw (widget=0x7c8f010) at /build/buildd/gtk+2.0-2.24.10/gtk/gtkwidget.c:3756
#5  0x00007fffe8f8ac8a in Oxygen::Gtk::gtk_widget_queue_draw (widget=0x7c8f010, rect=0x7d80978) at /home/ruslan/oxygen-gtk2/src/animations/../oxygengtkutils.h:233
#6  0x00007fffe8f9964c in Oxygen::WidgetStateData::delayedUpdate (pointer=0x7d80928) at /home/ruslan/oxygen-gtk2/src/animations/oxygenwidgetstatedata.cpp:100
#7  0x00007fffe8f92104 in Oxygen::TimeLine::trigger (this=0x7d80938) at /home/ruslan/oxygen-gtk2/src/animations/oxygentimeline.h:126
#8  0x00007fffe8f91fa7 in Oxygen::TimeLine::update (this=0x7d80938) at /home/ruslan/oxygen-gtk2/src/animations/oxygentimeline.cpp:126
#9  0x00007fffe8f933e3 in Oxygen::TimeLineServer::update (data=0x5e2f900) at /home/ruslan/oxygen-gtk2/src/animations/oxygentimelineserver.cpp:99
#10 0x00007ffff443c91b in g_timeout_dispatch (source=0x7c9d090, callback=<optimized out>, user_data=<optimized out>) at /build/buildd/glib2.0-2.32.3/./glib/gmain.c:3882
#11 0x00007ffff443bd53 in g_main_dispatch (context=0x1363b40) at /build/buildd/glib2.0-2.32.3/./glib/gmain.c:2539
#12 g_main_context_dispatch (context=0x1363b40) at /build/buildd/glib2.0-2.32.3/./glib/gmain.c:3075
#13 0x00007ffff443c0a0 in g_main_context_iterate (dispatch=1, block=<optimized out>, context=0x1363b40, self=<optimized out>) at /build/buildd/glib2.0-2.32.3/./glib/gmain.c:3146
#14 g_main_context_iterate (context=0x1363b40, block=<optimized out>, dispatch=1, self=<optimized out>) at /build/buildd/glib2.0-2.32.3/./glib/gmain.c:3083
#15 0x00007ffff443c49a in g_main_loop_run (loop=0x2241a60) at /build/buildd/glib2.0-2.32.3/./glib/gmain.c:3340
#16 0x00007ffff5d892f7 in IA__gtk_main () at /build/buildd/gtk+2.0-2.24.10/gtk/gtkmain.c:1329
#17 0x000000000065dfb0 in sp_main_gui(int, char const**) ()
#18 0x0000000000643408 in main ()

@Hugo
You can easily reproduce the crash if you set "Focus, mouseover ..." animation to 500ms instead of default 150ms.

Well, after all it appears that the crash occurs in several different cases, which are in fact one single reason: the widget is not on screen. This can mean it's not realized, and as far as I've checked, preventing queueing draw for unrealized widget prevents the crash. I'll now commit this, so please check if this fixes the crash.

Git commit 03682295cd58e9ed6bd396bc1b57fcc2123286ce by Ruslan Kabatsayev.
Committed on 13/07/2012 at 20:21.
Pushed by kabatsayev into branch 'master'.

Prevent queueing draw of unrealized widget so that gtkmm doesn't crash

M  +1    -1    src/animations/oxygenwidgetstatedata.cpp

http://commits.kde.org/oxygen-gtk/03682295cd58e9ed6bd396bc1b57fcc2123286ce

OK, I close this as FIXED. Please reopen if you still reproduce the bug after the commit above.

Just tried with the latest git oxygen-gtk2 and was not able to reproduce the bug.
Thanks guys :-)

Then closing for good.
Thanks for reporting !