From a355cd82c236e7753420a594ca11738d05f4f29f Mon Sep 17 00:00:00 2001
From: Richard Kimberly Heck <rikiheck@lyx.org>
Date: Mon, 2 Mar 2020 23:57:08 -0500
Subject: [PATCH] Fix bug #10316.

By sending the request through the usual dispatch machinery, we
make sure the cursor is valid when we're done.

(cherry picked from commit e5b6be0712a245901ec54aee44da45db77594382)
---
 src/frontends/qt4/TocWidget.cpp | 22 +++++++++++++++++-----
 status.23x                      |  3 +++
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/src/frontends/qt4/TocWidget.cpp b/src/frontends/qt4/TocWidget.cpp
index b96a7c644c..2cf7c35b08 100644
--- a/src/frontends/qt4/TocWidget.cpp
+++ b/src/frontends/qt4/TocWidget.cpp
@@ -179,7 +179,6 @@ bool TocWidget::getStatus(Cursor & cur, FuncRequest const & cmd,
 void TocWidget::doDispatch(Cursor & cur, FuncRequest const & cmd)
 {
 	Inset * inset = itemInset();
-	FuncRequest tmpcmd(cmd);
 
 	QModelIndex const & index = tocTV->currentIndex();
 	TocItem const & item =
@@ -191,14 +190,25 @@ void TocWidget::doDispatch(Cursor & cur, FuncRequest const & cmd)
 	switch (cmd.action())
 	{
 	case LFUN_CHANGE_ACCEPT:
-	case LFUN_CHANGE_REJECT:
+	case LFUN_CHANGE_REJECT: {
+		// The action is almost always LYX_UNKNOWN_ACTION, which will
+		// have the effect of moving the cursor to the location of
+		// the change. (See TocItem::action.)
 		dispatch(item.action());
-		cur.dispatch(tmpcmd);
+		// If we do not reset the origin, then the request will be sent back
+		// here, and we are in an infinite loop. But we need the dispatch
+		// machinery to clean up for us, if the cursor is in an inset that
+		// will be deleted. See bug #10316.
+		FuncRequest tmpcmd(cmd);
+		tmpcmd.setOrigin(FuncRequest::INTERNAL);
+		dispatch(tmpcmd);
+        cur.forceBufferUpdate();
 		break;
+	}
 
 	case LFUN_SECTION_SELECT:
 		dispatch(item.action());
-		cur.dispatch(tmpcmd);
+		cur.dispatch(cmd);
 		// necessary to get the selection drawn.
 		cur.buffer()->changed(true);
 		gui_view_.setFocus();
@@ -219,10 +229,12 @@ void TocWidget::doDispatch(Cursor & cur, FuncRequest const & cmd)
 		outline(cmd.action());
 		break;
 
-	default:
+	default: {
+		FuncRequest tmpcmd(cmd);
 		if (inset)
 			inset->dispatch(cur, tmpcmd);
 	}
+	}
 	cur.endUndoGroup();
 }
 
diff --git a/status.23x b/status.23x
index 610d0602a4..6a73c73bc1 100644
--- a/status.23x
+++ b/status.23x
@@ -43,6 +43,9 @@ What's new
 
 - Fix problem with drawing of auto-opened insets (bug 11870).
 
+- Fix crash when rejecting changes and the cursor is in an inset that will be
+  deleted (bug 10316).
+
 
 * INTERNALS