This crash seems to be repeatable by creating a type3 multi-layer font, creating a new layer on a glyph, and clicking on the Guide entry in the "Layers" window. I don't know why creating a new layer helps cause the crash.
if ( layer<0 ) /* Guide lines are special */
CVDrawLayerSplineSet(cv,pixmap,cv->b.layerheads[cv->b.drawmode],foreoutlinecol,
cv->showpoints ,&clip,strokeFillMode);
else if ( (cv->showback[layer>>5]&(1<<(layer&31))) ||
(!cv->show_ft_results && cv->dv==NULL )) {
for ( rf=cv->b.sc->layers[layer].refs; rf!=NULL; rf = rf->next ) {
if ( cv->showrefnames )
CVDrawRefName(cv,pixmap,rf,0);
enum outlinesfm_flags refsfm = sfm_stroke;
if( shouldShowFilledUsingCairo(cv) ) {
refsfm = sfm_fill;
}
for ( rlayer=0; rlayer<rf->layer_cnt; ++rlayer )
CVDrawSplineSetSpecialized(cv,pixmap,rf->layers[rlayer].splines,foreoutlinecol,-1,&clip, refsfm);
if ( rf->selected && cv->b.layerheads[cv->b.drawmode]==&cv->b.sc->layers[layer])
CVDrawBB(cv,pixmap,&rf->bb);
}
}
CVDrawLayerSplineSet(cv,pixmap,&cv->b.sc->layers[layer],foreoutlinecol,
cv->showpoints ,&clip,strokeFillMode);
if ( cv->freehand.current_trace!=NULL )
CVDrawSplineSet(cv,pixmap,cv->freehand.current_trace,tracecol,
false,&clip);
At the last CVDrawLayerSplineSet( ) "layer" can still be -1. When &cv->b.sc->layers[-1] is referenced in CVDrawLayerSplineSet() bad things happen.