evolution crashed with SIGSEGV in html_table_set_cell()

[Granito]

Binary package hint: evolution

I compose a new message and I select a new character dimension format after text selection and application crashed.

ProblemType: Crash
Architecture: i386
Date: Wed Dec 9 23:11:40 2009
DistroRelease: Ubuntu 9.10
ExecutablePath: /usr/bin/evolution
NonfreeKernelModules: nvidia
Package: evolution 2.28.1-0ubuntu2
ProcCmdline: evolution --component=mail
ProcEnviron:
 PATH=(custom, no user)
 LANG=it_IT.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-16.52-generic
SegvAnalysis:
 Segfault happened at: 0x45978ca <html_table_set_cell+58>: mov %edx,0x4(%edi)
 PC (0x045978ca) ok
 source "%edx" ok
 destination "0x4(%edi)" (0x00000004) not located in a known VMA region (needed writable region)!
SegvReason: writing NULL VMA
Signal: 11
SourcePackage: evolution
StacktraceTop:
 html_table_set_cell () from /usr/lib/libgtkhtml-3.14.so.19
 ?? () from /usr/lib/libgtkhtml-3.14.so.19
 ?? () from /usr/lib/libgtkhtml-3.14.so.19
 html_object_merge () from /usr/lib/libgtkhtml-3.14.so.19
 ?? () from /usr/lib/libgtkhtml-3.14.so.19
Title: evolution crashed with SIGSEGV in html_table_set_cell()
Uname: Linux 2.6.31-16-generic i686
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare users

[Granito (bpmail)]

The bug verified if selected body of message and signature of message (change format size character).

[Apport retracing service (apport)]

StacktraceTop:html_table_set_cell (table=0xaea1708, r=1, c=1, cell=0x0)
move_cell (t1=0xaea1708, t2=<value optimized out>,
merge (self=0xaea1708, with=0xadc3060, e=0x9f64658,
html_object_merge (self=0xaea1708, with=0xadc3060,
remove_empty_and_merge (e=<value optimized out>,

[Pedro Villavicencio (pedro)]

looks like a gtkhtml issue, I've send this upstream at: https://bugzilla.gnome.org/show_bug.cgi?id=604293 ; Thanks in advance.