Description of problem:
Pasting text from IRC into a reply crashed Evolution

Version-Release number of selected component (if applicable):
evolution-2.0.2-3
gtkhtml3-3.3.2-3

How reproducible:
occasional

Steps to Reproduce:
1. Reply to a message
2. Paste text from other app
3. Cross fingers
  
Actual results:
(gdb) bt
#0  0x001957a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x003fb42b in __waitpid_nocancel () from /lib/tls/libpthread.so.0
#2  0x03e13f50 in libgnomeui_module_info_get () from
/usr/lib/libgnomeui-2.so.0
#3  0x080637e0 in e_sidebar_new ()
#4  <signal handler called>
#5  0x0427b401 in html_text_calc_part_width (text=0x934c340,
    painter=0x8efe070,
    start=0x934b090 "<arjan> so the autoresolver cannot find
it\nwrote:\nI\n\n8\n\n\uffff\b\201\n\n\n\031On Thu, 2005-01-13 at
13:38 -0500, Jon Orris wrote:",
    offset=0, len=3, asc=0x934af1c, dsc=0x934af20) at htmltext.c:972
#6  0x0427b8ea in calc_preferred_width (self=0x934af00, painter=0x8efe070)
    at htmltext.c:998
#7  0x04264aa0 in html_object_calc_preferred_width (o=0x934af00,
    painter=0x8b0ae10) at htmlobject.c:953
#8  0x0427695c in html_text_real_calc_size (self=0x0, painter=0x8b0ae10,
    changed_objs=0xbff37b6c) at htmltext.c:740
#9  0x04263591 in html_object_calc_size (o=0x934af00, painter=0x8b0ae10,
    changed_objs=0x8b0ae10) at htmlobject.c:889
#10 0x0423598d in html_clue_flow_real_calc_size (o=0x934adc0,
    painter=0x8efe070, changed_objs=0xbff37b6c) at htmlclueflow.c:830
#11 0x04263591 in html_object_calc_size (o=0x934adc0, painter=0x8b0ae10,
    changed_objs=0x8b0ae10) at htmlobject.c:889
#12 0x042385cb in html_cluev_do_layout (o=0x92be668, painter=0x8efe070,
---Type <return> to continue, or q <return> to quit---q
calc_sizQuit
) at htmlcluev.c:205
#13 0x04263591 in html_object_calc_size (o=0x92be668, painter=0x8b0ae10,
    changed_objs=0x8b0ae10) at htmlobject.c:889
#14 0x04251fe2 in html_engine_calc_size (e=0x8d85cc8,
changed_objs=0xbff37b6c)
    at htmlengine.c:4882
#15 0x04259b63 in thaw_idle (data=0x8b0ae10) at htmlengine.c:5469
#16 0x00553b5a in g_child_watch_add () from /usr/lib/libglib-2.0.so.0
#17 0x005507bb in g_main_context_dispatch () from
/usr/lib/libglib-2.0.so.0
#18 0x00552242 in g_main_context_acquire () from /usr/lib/libglib-2.0.so.0
#19 0x005524ef in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#20 0x03bfbdd5 in bonobo_main () from /usr/lib/libbonobo-2.so.0
#21 0x08063af9 in main ()
(gdb) up 5
#5  0x0427b401 in html_text_calc_part_width (text=0x934c340,
    painter=0x8efe070,
    start=0x934b090 "<arjan> so the autoresolver cannot find
it\nwrote:\nI\n\n8\n\n\uffff\b\201\n\n\n\031On Thu, 2005-01-13 at
13:38 -0500, Jon Orris wrote:",
    offset=0, len=3, asc=0x934af1c, dsc=0x934af20) at htmltext.c:972
972                             if (len > 0 && (need_ascent_descent)
&& (pi->entries [idx].item->analysis.font != font || pi->entries
[idx].item->analysis.language != language)) {
(gdb) print entries
No symbol "entries" in current context.
(gdb) print idx
$1 = 1
(gdb) print pi->entries[idx]
$2 = {item = 0x0, widths = 0xd9}

(reading through NULL item pointer here causes segfault)


Expected results:
No crash

Additional info: