Thanks Kornel for the report:
https://www.mail-archive.com/lyx-devel@lists.lyx.org/msg198630.html
Apparently sanitize can crash. Use the safer fixIfBroken even though it
truncates the cursor.
// This is called from the Buffer, which has no way to ensure that cursors
// in BufferView remain valid.
if (documentBufferView())
- documentBufferView()->cursor().sanitize();
+ documentBufferView()->cursor().fixIfBroken();
// FIXME: This is slightly expensive, though less than the tocBackend update
// (#9880). This also resets the view in the Toc Widget (#6675).
d.toc_models_.reset(documentBufferView());