Created attachment 34970 [details]
test file

Notice that A2 seems to have the exact same content that A1 does, but it doesn't
crash.

Unfortunately I don't what I did in A1 to make it crashy. I made the minimized
test case from a normal .gnumeric file of mine that crashed, and I don't
remember doing anything silly there when editing it. I suppose I did something
in the wrong order and got Gnumeric confused.

Confirmed.

Fixed in cvs.  we might still have an issue while editing.

for the record, the string was "E \303\244 affffffffffffffffffffffffffffffff"
and the attributes were:

PangoAttrList at 6f5138
  start=0; end=2
    scale=1
    family="Sans"
    size=10240
    style=0
    weight=400
    foreground=0000:0000:0000
    strikethrough=0
    underline=0
  start=2; end=4
    scale=1
    family="Sans"
    size=10240
    style=0
    strikethrough=0
    underline=0
    weight=700
    foreground=3333:9999:6666
  start=4; end=0
    scale=1
    family="Sans"
    size=10240
    style=0
    strikethrough=0
    underline=0
    weight=400
    foreground=0000:0000:0000
  start=0; end=33
    scale=1
    strikethrough=0
    family="Sans"
    size=10240
    style=0
    weight=400
    foreground=0000:0000:0000
    underline=0
  start=33; end=2147483647
    scale=1
    family="Sans"
    size=10240
    style=0
    strikethrough=0
    underline=0
    weight=400
    foreground=0000:0000:0000