Fix bug #10316.

By sending the request through the usual dispatch machinery, we
make sure the cursor is valid when we're done.

(cherry picked from commit e5b6be0712a245901ec54aee44da45db77594382)

diff --git a/src/frontends/qt4/TocWidget.cpp b/src/frontends/qt4/TocWidget.cpp
index b96a7c644cfc97e657066f6823c51f02e4ddc852..2cf7c35b085d041bd47e8bd9a6e5cbba9f700944 100644 (file)
--- a/src/frontends/qt4/TocWidget.cpp
+++ b/src/frontends/qt4/TocWidget.cpp
@@ -179,7 +179,6 @@ bool TocWidget::getStatus(Cursor & cur, FuncRequest const & cmd,
 void TocWidget::doDispatch(Cursor & cur, FuncRequest const & cmd)
 {
        Inset * inset = itemInset();
-       FuncRequest tmpcmd(cmd);
 
        QModelIndex const & index = tocTV->currentIndex();
        TocItem const & item =
@@ -191,14 +190,25 @@ void TocWidget::doDispatch(Cursor & cur, FuncRequest const & cmd)
        switch (cmd.action())
        {
        case LFUN_CHANGE_ACCEPT:
-       case LFUN_CHANGE_REJECT:
+       case LFUN_CHANGE_REJECT: {
+               // The action is almost always LYX_UNKNOWN_ACTION, which will
+               // have the effect of moving the cursor to the location of
+               // the change. (See TocItem::action.)
                dispatch(item.action());
-               cur.dispatch(tmpcmd);
+               // If we do not reset the origin, then the request will be sent back
+               // here, and we are in an infinite loop. But we need the dispatch
+               // machinery to clean up for us, if the cursor is in an inset that
+               // will be deleted. See bug #10316.
+               FuncRequest tmpcmd(cmd);
+               tmpcmd.setOrigin(FuncRequest::INTERNAL);
+               dispatch(tmpcmd);
+        cur.forceBufferUpdate();
                break;
+       }
 
        case LFUN_SECTION_SELECT:
                dispatch(item.action());
-               cur.dispatch(tmpcmd);
+               cur.dispatch(cmd);
                // necessary to get the selection drawn.
                cur.buffer()->changed(true);
                gui_view_.setFocus();
@@ -219,10 +229,12 @@ void TocWidget::doDispatch(Cursor & cur, FuncRequest const & cmd)
                outline(cmd.action());
                break;
 
-       default:
+       default: {
+               FuncRequest tmpcmd(cmd);
                if (inset)
                        inset->dispatch(cur, tmpcmd);
        }
+       }
        cur.endUndoGroup();
 }
 

diff --git a/status.23x b/status.23x
index 610d0602a4e229e4f95069877b546148fdb62301..6a73c73bc12f5aa3a878f9c08a0f6d078f04e311 100644 (file)
--- a/status.23x
+++ b/status.23x
@@ -43,6 +43,9 @@ What's new
 
 - Fix problem with drawing of auto-opened insets (bug 11870).
 
+- Fix crash when rejecting changes and the cursor is in an inset that will be
+  deleted (bug 10316).
+
 
 * INTERNALS