crash on quit (sporadic)

Steps to reproduce:

• open Inkscape
• do some stuff then quit (Ctrl+Q)

I am hardpressed to find minimal steps, but opening a file and selecting random objects and moving them with the XML editor dialog open then quitting (Ctrl+Q) to close triggered it at the last attempt.

Simplest steps I've done to crash:

1. Open Inkscape (default preferences except Icon dialog was open)
2. Close dialog
3. Ctrl+Q to quit

What happened?

Crash occassionally. I managed to capture a backtrace twice. Most of the time there isn't a crash. Truncated backtrace below.

Full backtrace attached (its taken from a separate backtrace though): inkscape-exit-backtrace.txt

malloc_consolidate(): invalid chunk size

Thread 1 "inkscape" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) set pagination off
(gdb) bt
#0  0x00007ffff3e02e97 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff3e04801 in __GI_abort () at abort.c:79
#2  0x00007ffff3e4d897 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff3f7ab9a "%s\n") at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007ffff3e5490a in malloc_printerr (str=str@entry=0x7ffff3f7c3f0 "malloc_consolidate(): invalid chunk size") at malloc.c:5350
#4  0x00007ffff3e54bae in malloc_consolidate (av=av@entry=0x7ffff41afc40 <main_arena>) at malloc.c:4441
#5  0x00007ffff3e587d8 in _int_malloc (av=av@entry=0x7ffff41afc40 <main_arena>, bytes=bytes@entry=1352) at malloc.c:3703
#6  0x00007ffff3e5e0b1 in __libc_calloc (n=<optimised out>, elem_size=<optimised out>) at malloc.c:3436
#7  0x00007ffff5c10b11 in g_malloc0 (n_bytes=n_bytes@entry=1352) at ../../../../glib/gmem.c:129
#8  0x00007ffff46bda73 in _gtk_css_lookup_new (relevant=relevant@entry=0x0) at ../../../../gtk/gtkcsslookup.c:32
#9  0x00007ffff46d2253 in gtk_css_static_style_new_compute (provider=0x5555557ff730, matcher=matcher@entry=0x7fffffffa750, parent=parent@entry=0x0) at ../../../../gtk/gtkcssstaticstyle.c:183
#10 0x00007ffff46c0124 in gtk_css_node_create_style (cssnode=0x555557901120 [GtkCssWidgetNode]) at ../../../../gtk/gtkcssnode.c:371
#11 0x00007ffff46c0124 in gtk_css_node_real_update_style (cssnode=0x555557901120 [GtkCssWidgetNode], change=55834574648, timestamp=0, style=0x5555581422f0 [GtkCssStaticStyle]) at ../../../../gtk/gtkcssnode.c:425
#12 0x00007ffff46bef34 in gtk_css_node_ensure_style (cssnode=0x555557901120 [GtkCssWidgetNode], current_time=current_time@entry=0) at ../../../../gtk/gtkcssnode.c:1007
#13 0x00007ffff46bf0cf in gtk_css_node_ensure_style (current_time=0, cssnode=<optimised out>) at ../../../../gtk/gtkcssnode.c:992
#14 0x00007ffff46bf0cf in gtk_css_node_ensure_style (cssnode=cssnode@entry=0x555557905200 [GtkCssWidgetNode], current_time=0) at ../../../../gtk/gtkcssnode.c:996
#15 0x00007ffff46bf146 in gtk_css_node_ensure_style (current_time=<optimised out>, cssnode=0x555557905200 [GtkCssWidgetNode]) at ../../../../gtk/gtkcssnode.c:992
#16 0x00007ffff46bf146 in gtk_css_node_get_style (cssnode=0x555557905200 [GtkCssWidgetNode]) at ../../../../gtk/gtkcssnode.c:1033

I have no reason to think this is a recent regression (I don't normally exit Inkscape this way), but its rather alarmingly frequent (well, more than once a day anyhow)

Without gdb, it crashes like this (yes, it seems to hang):

malloc_consolidate(): invalid chunk size

Emergency save activated!
^C

What happens if we look at the backtrace where Emergency save activated! hangs:

#0  0x00007ffff3ef46ac in __lll_lock_wait_private ()
    at ../sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:95
#1  0x00007ffff3e5cf7e in __GI___libc_realloc (oldmem=0x555557946170, bytes=32)
    at malloc.c:3228
#2  0x00007ffff5c10b70 in g_realloc (mem=<optimised out>, n_bytes=32)
    at ../../../../glib/gmem.c:164
#3  0x00007ffff5c2d147 in g_string_maybe_expand (string=0x555555a2dae0, len=<optimised out>) at ../../../../glib/gstring.c:102
#4  0x00007ffff5c2d4d5 in g_string_insert_len (string=0x555555a2dae0, pos=<optimised out>, val=0x5555589e17e1 "home/nal/Downloads", len=<optimised out>)
    at ../../../../glib/gstring.c:476
#5  0x00007ffff5bf6af2 in g_build_path_va (separator=separator@entry=0x7ffff5c56e70 "/", first_element=<optimised out>, args=args@entry=0x7fffffff9440, str_array=str_array@entry=0x0) at ../../../../glib/gfileutils.c:1755
#6  0x00007ffff5bf7f25 in g_build_filename_va (str_array=0x0, args=0x7fffffff9440, first_argument=<optimised out>) at ../../../../glib/gfileutils.c:1976
#7  0x00007ffff5bf7f25 in g_build_filename (first_element=<optimised out>)
    at ../../../../glib/gfileutils.c:2058
#8  0x00007ffff723cd3b in Inkscape::Application::crash_handler(int) ()
    at ../src/inkscape.cpp:583

Not sure if it occurs in appimages or the ppa release. I think all tests have been done before I restarted my computer though. I'll update after a restart if I can still replicate.

Inkscape Version and Operating System:

• Inkscape 1.1-dev (977be01308, 2020-02-27) debug build Linux Mint 19.1

Edit: related https://bugs.launchpad.net/inkscape/+bug/909687 . Google finds a couple other applications that also crash in a similar fashion too but no useful information. still have not been able to reproduce since restart. Just had it happen again. Unfortunately, I wasn't paying enough attention again. Nothing abnormal on System Monitor (about 92% use with Inkscape open). Again not doing anything interesting, XML editor was open.