Crash when exposing layers

[jhps]

This crash seems to be repeatable by creating a type3 multi-layer font, creating a new layer on a glyph, and clicking on the Guide entry in the "Layers" window. I don't know why creating a new layer helps cause the crash.

In:

static void CVExpose(CharView *cv, GWindow pixmap, GEvent *event )

at charview.c : 2482 we get:

if ( layer<0 ) /* Guide lines are special */
    CVDrawLayerSplineSet(cv,pixmap,cv->b.layerheads[cv->b.drawmode],foreoutlinecol,
            cv->showpoints ,&clip,strokeFillMode);
else if ( (cv->showback[layer>>5]&(1<<(layer&31))) ||
        (!cv->show_ft_results && cv->dv==NULL )) {
    for ( rf=cv->b.sc->layers[layer].refs; rf!=NULL; rf = rf->next ) {
        if ( cv->showrefnames )
            CVDrawRefName(cv,pixmap,rf,0);
        enum outlinesfm_flags refsfm = sfm_stroke;
        if( shouldShowFilledUsingCairo(cv) ) {
            refsfm = sfm_fill;
        }
        for ( rlayer=0; rlayer<rf->layer_cnt; ++rlayer )
            CVDrawSplineSetSpecialized(cv,pixmap,rf->layers[rlayer].splines,foreoutlinecol,-1,&clip, refsfm);
        if ( rf->selected && cv->b.layerheads[cv->b.drawmode]==&cv->b.sc->layers[layer])
            CVDrawBB(cv,pixmap,&rf->bb);
    }
}
CVDrawLayerSplineSet(cv,pixmap,&cv->b.sc->layers[layer],foreoutlinecol,
                     cv->showpoints ,&clip,strokeFillMode);

if ( cv->freehand.current_trace!=NULL )
    CVDrawSplineSet(cv,pixmap,cv->freehand.current_trace,tracecol,
            false,&clip);

At the last CVDrawLayerSplineSet( ) "layer" can still be -1. When &cv->b.sc->layers[-1] is referenced in CVDrawLayerSplineSet() bad things happen.