From 0a61ff13427b5663c662180c3d3d0959982a512e Mon Sep 17 00:00:00 2001
From: Juergen Spitzmueller <spitz@lyx.org>
Date: Fri, 4 Apr 2014 16:28:21 +0200
Subject: [PATCH] Set cursor pos after cursor idx to avoid invalid cursor.

Fixes: #9076
---
 src/mathed/InsetMathNest.cpp | 2 +-
 status.20x                   | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/mathed/InsetMathNest.cpp b/src/mathed/InsetMathNest.cpp
index 1e555ce32b..1c498dc2ce 100644
--- a/src/mathed/InsetMathNest.cpp
+++ b/src/mathed/InsetMathNest.cpp
@@ -730,8 +730,8 @@ void InsetMathNest::doDispatch(Cursor & cur, FuncRequest & cmd)
 		cur.idx() = 0;
 		cur.resetAnchor();
 		cur.setSelection(true);
-		cur.pos() = cur.lastpos();
 		cur.idx() = cur.lastidx();
+		cur.pos() = cur.lastpos();
 		cur.bv().cursor() = cur;
 		break;
 
diff --git a/status.20x b/status.20x
index 9f6642db6f..0e6ad635fa 100644
--- a/status.20x
+++ b/status.20x
@@ -100,6 +100,8 @@ What's new
 - Fix crash when performing "Change Case" operation on a selection with font
   changes (bug 7943).
 
+- Fix crash when performing selection in math insets (bug 9076).
+
 - Fix hang when selecting text (bug 8837).
 
 - Fix assertion when entering a path into the import dialog (bug 7437).