From 191d44a5571402516719c01f9febd6437bc18837 Mon Sep 17 00:00:00 2001
From: Jean-Marc Lasgouttes <lasgouttes@lyx.org>
Date: Fri, 27 Sep 2013 10:47:36 +0200
Subject: [PATCH] Fix bug #8884: Crash when "navigate to next change"

The two fixes here a obviously right, although it is not clear why they are sufficient to fix the bug. Anyway I cannot reproduce any crash with it.

 * the first part just conditions a whole if/else to change_next_pos.changed(). Originally, only the if branch was concerned.

 * the second part is to avoid calling CursorSlice::backwardPos() when position is 0. Doing this leads to an assertion.
---
 src/lyxfind.cpp | 21 ++++++++++++---------
 status.20x      |  5 ++++-
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/src/lyxfind.cpp b/src/lyxfind.cpp
index 5c958015d3..5cb5c2189f 100644
--- a/src/lyxfind.cpp
+++ b/src/lyxfind.cpp
@@ -421,21 +421,24 @@ bool findChange(BufferView * bv, bool next)
 	// of this function). This will avoid changes to be selected half.
 	bool search_both_sides = false;
 	Cursor tmpcur = cur;
-	// Leave math first
+	// Find enclosing text cursor
 	while (tmpcur.inMathed())
 		tmpcur.pop_back();
 	Change change_next_pos
 		= tmpcur.paragraph().lookupChange(tmpcur.pos());
-	if (change_next_pos.changed() && cur.inMathed()) {
-		cur = tmpcur;
-		search_both_sides = true;
-	} else if (tmpcur.pos() > 0 && tmpcur.inTexted()) {
-		Change change_prev_pos
-			= tmpcur.paragraph().lookupChange(tmpcur.pos() - 1);
-		if (change_next_pos.isSimilarTo(change_prev_pos))
+	if (change_next_pos.changed()) {
+		if (cur.inMathed()) {
+			cur = tmpcur;
 			search_both_sides = true;
+		} else if (tmpcur.pos() > 0 && tmpcur.inTexted()) {
+			Change change_prev_pos
+				= tmpcur.paragraph().lookupChange(tmpcur.pos() - 1);
+			if (change_next_pos.isSimilarTo(change_prev_pos))
+				search_both_sides = true;
+		}
 	}
 
+	// find the next change
 	if (!findChange(cur, next))
 		return false;
 
@@ -443,7 +446,7 @@ bool findChange(BufferView * bv, bool next)
 
 	CursorSlice & tip = cur.top();
 
-	if (!next)
+	if (!next && tip.pos() > 0)
 		// take a step into the change
 		tip.backwardPos();
 
diff --git a/status.20x b/status.20x
index 66f5198223..dfe64f7b31 100644
--- a/status.20x
+++ b/status.20x
@@ -77,7 +77,10 @@ What's new
 
 - Fix hang when using BibTeX files with really long author lists (bug 8944).
 
-- Fix crash with changetracking in bibliography environment (bug 8646).
+- Fix crash with changetracking in bibliography environment (bug
+  8646).
+
+- Fix crash when navigating to next change (bug 8884).
 
 - Fix crash when optional argument inside a math macro was deleted (bug 8329).