With gtk+, pango and glib from today's (2004-10-27) cvs HEAD.

Steps to reproduce:
0) Start testentrycompletion
1) Type something
2) Press backspace

==24153== Invalid read of size 1
==24153==    at 0x1BA2F595: gtk_entry_backspace (gtkentry.c:2539)
==24153==    by 0x1BCB3C66: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==24153==    by 0x1BCA3175: g_type_class_meta_marshal (gclosure.c:514)
==24153==    by 0x1BCA2F3D: g_closure_invoke (gclosure.c:437)
==24153==    by 0x1BCB325E: signal_emit_unlocked_R (gsignal.c:2480)
==24153==    by 0x1BCB209C: g_signal_emitv (gsignal.c:2113)
==24153==    by 0x1B9D93A9: gtk_binding_entry_activate (gtkbindings.c:526)
==24153==    by 0x1B9D9EA8: binding_match_activate (gtkbindings.c:928)
==24153==    by 0x1B9DA0D9: gtk_bindings_activate_list (gtkbindings.c:1064)
==24153==    by 0x1B9DA301: gtk_bindings_activate_event (gtkbindings.c:1139)
==24153==    by 0x1BB75089: gtk_widget_real_key_press_event (gtkwidget.c:3331)
==24153==    by 0x1BA2E1F4: gtk_entry_key_press (gtkentry.c:1825)
==24153==    by 0x1BA963CB: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:83)
==24153==    by 0x1BCA3175: g_type_class_meta_marshal (gclosure.c:514)
==24153==    by 0x1BCA2F3D: g_closure_invoke (gclosure.c:437)
==24153==    by 0x1BCB325E: signal_emit_unlocked_R (gsignal.c:2480)
==24153==    by 0x1BCB273C: g_signal_emit_valist (gsignal.c:2211)
==24153==    by 0x1BCB2B92: g_signal_emit (gsignal.c:2245)
==24153==    by 0x1BB753EB: gtk_widget_event_internal (gtkwidget.c:3587)
==24153==    by 0x1BA351EB: gtk_entry_completion_popup_key_press
(gtkentrycompletion.c:738)
==24153==    by 0x1BA963CB: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:83)
==24153==    by 0x1BCA2F3D: g_closure_invoke (gclosure.c:437)
==24153==    by 0x1BCB37BD: signal_emit_unlocked_R (gsignal.c:2442)
==24153==    by 0x1BCB273C: g_signal_emit_valist (gsignal.c:2211)
==24153==    by 0x1BCB2B92: g_signal_emit (gsignal.c:2245)
==24153==    by 0x1BB753EB: gtk_widget_event_internal (gtkwidget.c:3587)
==24153==    by 0x1BA94E4D: gtk_propagate_event (gtkmain.c:2072)
==24153==    by 0x1BA93D16: gtk_main_do_event (gtkmain.c:1336)
==24153==    by 0x1B955B49: gdk_event_dispatch (gdkevents-x11.c:2207)
==24153==    by 0x1BCF339F: g_main_dispatch (gmain.c:1943)
==24153==  Address 0x1C2E2BDD is 1 bytes after a block of size 12 alloc'd
==24153==    at 0x1B904A80: malloc (vg_replace_malloc.c:131)
==24153==    by 0x1BCF8921: g_malloc (gmem.c:137)
==24153==    by 0x1BC796FE: pango_layout_get_log_attrs (pango-layout.c:937)
==24153==    by 0x1BA2F58B: gtk_entry_backspace (gtkentry.c:2537)
==24153==    by 0x1BCB3C66: g_cclosure_marshal_VOID__VOID (gmarshal.c:77)
==24153==    by 0x1BCA3175: g_type_class_meta_marshal (gclosure.c:514)
==24153==    by 0x1BCA2F3D: g_closure_invoke (gclosure.c:437)
==24153==    by 0x1BCB325E: signal_emit_unlocked_R (gsignal.c:2480)
==24153==    by 0x1BCB209C: g_signal_emitv (gsignal.c:2113)
==24153==    by 0x1B9D93A9: gtk_binding_entry_activate (gtkbindings.c:526)
==24153==    by 0x1B9D9EA8: binding_match_activate (gtkbindings.c:928)
==24153==    by 0x1B9DA0D9: gtk_bindings_activate_list (gtkbindings.c:1064)
==24153==    by 0x1B9DA301: gtk_bindings_activate_event (gtkbindings.c:1139)
==24153==    by 0x1BB75089: gtk_widget_real_key_press_event (gtkwidget.c:3331)
==24153==    by 0x1BA2E1F4: gtk_entry_key_press (gtkentry.c:1825)
==24153==    by 0x1BA963CB: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:83)
==24153==    by 0x1BCA3175: g_type_class_meta_marshal (gclosure.c:514)
==24153==    by 0x1BCA2F3D: g_closure_invoke (gclosure.c:437)
==24153==    by 0x1BCB325E: signal_emit_unlocked_R (gsignal.c:2480)
==24153==    by 0x1BCB273C: g_signal_emit_valist (gsignal.c:2211)
==24153==    by 0x1BCB2B92: g_signal_emit (gsignal.c:2245)
==24153==    by 0x1BB753EB: gtk_widget_event_internal (gtkwidget.c:3587)
==24153==    by 0x1BA351EB: gtk_entry_completion_popup_key_press
(gtkentrycompletion.c:738)
==24153==    by 0x1BA963CB: _gtk_marshal_BOOLEAN__BOXED (gtkmarshalers.c:83)
==24153==    by 0x1BCA2F3D: g_closure_invoke (gclosure.c:437)
==24153==    by 0x1BCB37BD: signal_emit_unlocked_R (gsignal.c:2442)
==24153==    by 0x1BCB273C: g_signal_emit_valist (gsignal.c:2211)
==24153==    by 0x1BCB2B92: g_signal_emit (gsignal.c:2245)