commit 7f0ac0932b475e95cac9565cefbcede9e170c7c1
Author: Jean-Marc Lasgouttes <[email protected]>
Date:   Fri May 22 18:16:23 2015 +0200

    Avoid crash with undo in a closed collapsable inset
    
    The recipe for reproducing this crash is to do a search and replace
    that changes a string present in a collapsed inset, and then undo.
    
    This is a followup to 17e435c4, which used editable() instead of
    isActive(); this commit was amended at c2f785bd, since editable() is
    not set properly in mathed.
    
    Truth is, editable() is not the right property to test against, since
    it is false for a collapsed inset, which does not prevent a cursor
    from pointing inside. Therefore sanitize should not change the cursor
    in this case.
    
    Hopefuly, this is the last word on the subject. Alternative would be
    to drop this if()-clause completely.

diff --git a/src/DocIterator.cpp b/src/DocIterator.cpp
index 9783db1..352aa3a 100644
--- a/src/DocIterator.cpp
+++ b/src/DocIterator.cpp
@@ -590,8 +590,7 @@ void DocIterator::sanitize()
                        fixIfBroken();
                        break;
                }
-               if ((inset->inMathed() && !inset->isActive())
-                   || (!inset->inMathed() && !inset->editable())) {
+               if (!inset->isActive()) {
                        LYXERR0("Inset found on cursor stack is not active.");
                        fixIfBroken();
                        break;
diff --git a/src/Undo.cpp b/src/Undo.cpp
index d7bcd75..7a1c6fd 100644
--- a/src/Undo.cpp
+++ b/src/Undo.cpp
@@ -434,10 +434,12 @@ void Undo::Private::doTextUndoOrRedo(CursorData & cur, 
UndoElementStack & stack,
 
        if (undo.bparams)
                doRecordUndoBufferParams(undo.cur_after, otherstack);
-       else
+       else {
+               LATTEST(undo.end <= cell_dit.lastpit());
                doRecordUndo(ATOMIC_UNDO, cell_dit,
                                         undo.from, cell_dit.lastpit() - 
undo.end, undo.cur_after,
                                         otherstack);
+       }
        otherstack.top().cur_after = undo.cur_before;
 
        // This does the actual undo/redo.

Reply via email to