From c98ce56a03411021152b340bdb418d4d01d61548 Mon Sep 17 00:00:00 2001
From: Jean-Marc Lasgouttes <lasgouttes@lyx.org>
Date: Fri, 27 Sep 2013 10:47:36 +0200
Subject: [PATCH] Fix bug #8884: Crash when "navigate to next change"

The two fixes here a obviously right, although it is not clear why they are sufficient to fix the bug. Anyway I cannot reproduce any crash with it.

 * the first part just conditions a whole if/else to change_next_pos.changed(). Originally, only the if branch was concerned.

 * the second part is to avoid calling CursorSlice::backwardPos() when position is 0. Doing this leads to an assertion.
---
 src/lyxfind.cpp | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/src/lyxfind.cpp b/src/lyxfind.cpp
index a1cab4caa5..ca43d47e92 100644
--- a/src/lyxfind.cpp
+++ b/src/lyxfind.cpp
@@ -419,21 +419,24 @@ bool findChange(BufferView * bv, bool next)
 	// of this function). This will avoid changes to be selected half.
 	bool search_both_sides = false;
 	Cursor tmpcur = cur;
-	// Leave math first
+	// Find enclosing text cursor
 	while (tmpcur.inMathed())
 		tmpcur.pop_back();
 	Change change_next_pos
 		= tmpcur.paragraph().lookupChange(tmpcur.pos());
-	if (change_next_pos.changed() && cur.inMathed()) {
-		cur = tmpcur;
-		search_both_sides = true;
-	} else if (tmpcur.pos() > 0 && tmpcur.inTexted()) {
-		Change change_prev_pos
-			= tmpcur.paragraph().lookupChange(tmpcur.pos() - 1);
-		if (change_next_pos.isSimilarTo(change_prev_pos))
+	if (change_next_pos.changed()) {
+		if (cur.inMathed()) {
+			cur = tmpcur;
 			search_both_sides = true;
+		} else if (tmpcur.pos() > 0 && tmpcur.inTexted()) {
+			Change change_prev_pos
+				= tmpcur.paragraph().lookupChange(tmpcur.pos() - 1);
+			if (change_next_pos.isSimilarTo(change_prev_pos))
+				search_both_sides = true;
+		}
 	}
 
+	// find the next change
 	if (!findChange(cur, next))
 		return false;
 
@@ -441,7 +444,7 @@ bool findChange(BufferView * bv, bool next)
 
 	CursorSlice & tip = cur.top();
 
-	if (!next)
+	if (!next && tip.pos() > 0)
 		// take a step into the change
 		tip.backwardPos();