Crash in TOC dialog after inserting note and then undoing it

[sts@…]

Create a new document. Add section "Foo". Insert a LyX note (any float will do)
in the next line. Undo. => CRASH

Program received signal: "EXC_BAD_ACCESS".
(gdb) backtrace
#0 0x00000000 in ?? ()
#1 0x003d9e36 in lyx::DocIterator::inMathed (this=0xbfffc728) at
/Users/sts/Quellen/mac/lyx-devel/src/BufferView.cpp:132
#2 0x00117878 in lyx::TocBackend::item (this=0x1383a4cc, type=@0x2174e4a0,
par_it=@0xbfffc7d8) at /Users/sts/Quellen/mac/lyx-devel/src/TocBackend.cpp:234
#3 0x00334e3c in lyx::frontend::ControlToc::getCurrentTocItem (this=0x21732468,
type=0) at
/Users/sts/Quellen/mac/lyx-devel/src/frontends/controllers/ControlToc.cpp:130
#4 0x002b70b1 in lyx::frontend::QToc::getCurrentIndex (this=0x21732460, type=0)
at /Users/sts/Quellen/mac/lyx-devel/src/frontends/qt4/QToc.cpp:90
#5 0x002be93c in lyx::frontend::TocWidget::setTocModel (this=0x2174ac50,
type=0) at /Users/sts/Quellen/mac/lyx-devel/src/frontends/qt4/TocWidget.cpp:293
#6 0x002bf469 in lyx::frontend::TocWidget::updateGui (this=0x2174ac50) at
/Users/sts/Quellen/mac/lyx-devel/src/frontends/qt4/TocWidget.cpp:268
#7 0x002bf53f in lyx::frontend::TocWidget::qt_metacall (this=0x2174ac50,
_c=InvokeMetaMethod, _id=0, _a=0xbfffcdf8) at
/Users/sts/Quellen/mac/lyx-devel/build/src/frontends/qt4/TocWidget_moc.cpp:84
#8 0x128cd83b in QMetaObject::activate ()
#9 0x002b6fe1 in lyx::frontend::QToc::modelReset (this=0x21732460) at
/Users/sts/Quellen/mac/lyx-devel/build/src/frontends/qt4/QToc_moc.cpp:76
#10 0x002b77e0 in lyx::frontend::QToc::initialiseParams (this=0x21732460,
data=@0xbfffcf50) at /Users/sts/Quellen/mac/lyx-devel/src/frontends/qt4/QToc.cpp:119
#11 0x00318cc5 in lyx::frontend::Dialog::update (this=0x217352c0,
data=@0xbfffcf50) at
/Users/sts/Quellen/mac/lyx-devel/src/frontends/controllers/Dialog.cpp:95
#12 0x0021b810 in lyx::Dialogs::update (this=0x134b5eb0, name=@0xbfffcf58,
data=@0xbfffcf50) at /Users/sts/Quellen/mac/lyx-devel/src/frontends/Dialogs.cpp:148
#13 0x0021c769 in lyx::LyXView::updateDialog (this=0x134b56f4, name=@0xbfffcf58,
data=@0xbfffcf50) at /Users/sts/Quellen/mac/lyx-devel/src/frontends/LyXView.cpp:307
#14 0x0021c7e0 in lyx::LyXView::updateToc (this=0x134b56f4) at
/Users/sts/Quellen/mac/lyx-devel/src/frontends/LyXView.cpp:327
#15 0x0059ec16 in boost::_mfi::mf0<void, lyx::LyXView>::operator()
(this=0x20ac21a8, p=0x134b56f4) at
/Users/sts/Quellen/mac/lyx-devel/boost/boost/bind/mem_fn_template.hpp:49
#16 0x005a0faa in boost::_bi::list1<boost::_bi::value<lyx::LyXView*>

::operator()<boost::_mfi::mf0<void, lyx::LyXView>, boost::_bi::list0>

(this=0x20ac21b0, f=@0x20ac21a8, a=@0xbfffcffe) at
/Users/sts/Quellen/mac/lyx-devel/boost/boost/bind.hpp:231
#17 0x005a0fed in boost::_bi::bind_t<void, boost::_mfi::mf0<void, lyx::LyXView>,
boost::_bi::list1<boost::_bi::value<lyx::LyXView*> > >::operator()
(this=0x20ac21a8) at
/Users/sts/Quellen/mac/lyx-devel/boost/boost/bind/bind_template.hpp:20
#18 0x005a1007 in
boost::detail::function::void_function_obj_invoker0<boost::_bi::bind_t<void,
boost::_mfi::mf0<void, lyx::LyXView>,
boost::_bi::list1<boost::_bi::value<lyx::LyXView*> > >, void>::invoke
(function_obj_ptr=@0x20ac21a8) at
/Users/sts/Quellen/mac/lyx-devel/boost/boost/function/function_template.hpp:155
#19 0x003a35ab in boost::function0<void, std::allocator<void> >::operator()
(this=0x20ac21a4) at
/Users/sts/Quellen/mac/lyx-devel/boost/boost/function/function_template.hpp:692
#20 0x003a35d6 in
boost::signals::detail::call_bound0<void>::caller<boost::function<void ()(),
std::allocator<void> >

::operator()<boost::signals::detail::connection_slot_pair> (this=0xbfffd398,

slot=@0x20ac2188) at
/Users/sts/Quellen/mac/lyx-devel/boost/boost/signals/signal_template.hpp:119
#21 0x003a393a in
boost::signals::detail::slot_call_iterator<boost::signals::detail::call_bound0<void>::caller<boost::function<void
()(), std::allocator<void> > >,
boost::signals::detail::named_slot_map_iterator>::dereference (this=0xbfffd318)
at
/Users/sts/Quellen/mac/lyx-devel/boost/boost/signals/detail/slot_call_iterator.hpp:61
#22 0x003a3979 in
boost::iterator_core_access::dereference<boost::signals::detail::slot_call_iterator<boost::signals::detail::call_bound0<void>::caller<boost::function<void
()(), std::allocator<void> > >, boost::signals::detail::named_slot_map_iterator>

(f=@0xbfffd318) at

/Users/sts/Quellen/mac/lyx-devel/boost/boost/iterator/iterator_facade.hpp:517
#23 0x003a3995 in
boost::iterator_facade<boost::signals::detail::slot_call_iterator<boost::signals::detail::call_bound0<void>::caller<boost::function<void
()(), std::allocator<void> > >,
boost::signals::detail::named_slot_map_iterator>,
boost::signals::detail::unusable, boost::single_pass_traversal_tag,
boost::signals::detail::unusable const&, int>::operator* (this=0xbfffd318) at
/Users/sts/Quellen/mac/lyx-devel/boost/boost/iterator/iterator_facade.hpp:635
#24 0x003a39a9 in
boost::detail::postfix_increment_proxy<boost::signals::detail::slot_call_iterator<boost::signals::detail::call_bound0<void>::caller<boost::function<void
()(), std::allocator<void> > >, boost::signals::detail::named_slot_map_iterator>

::postfix_increment_proxy (this=0xbfffd16f, x=@0xbfffd318) at

/Users/sts/Quellen/mac/lyx-devel/boost/boost/iterator/iterator_facade.hpp:144
#25 0x003a39c4 in
boost::operator++<boost::signals::detail::slot_call_iterator<boost::signals::detail::call_bound0<void>::caller<boost::function<void
()(), std::allocator<void> > >,
boost::signals::detail::named_slot_map_iterator>,
boost::signals::detail::unusable, boost::single_pass_traversal_tag,
boost::signals::detail::unusable const&, int> (i=@0xbfffd318) at
/Users/sts/Quellen/mac/lyx-devel/boost/boost/iterator/iterator_facade.hpp:733
#26 0x003a39f3 in
boost::last_value<void>::operator()<boost::signals::detail::slot_call_iterator<boost::signals::detail::call_bound0<void>::caller<boost::function<void
()(), std::allocator<void> > >, boost::signals::detail::named_slot_map_iterator>

(this=0x20aa2fd4, first=@0xbfffd318, last=@0xbfffd210) at

/Users/sts/Quellen/mac/lyx-devel/boost/boost/last_value.hpp:43
#27 0x003a3baa in boost::signal0<void, boost::last_value<void>, int,
std::less<int>, boost::function<void ()(), std::allocator<void> > >::operator()
(this=0x134cd8f0) at
/Users/sts/Quellen/mac/lyx-devel/boost/boost/signals/signal_template.hpp:354
#28 0x00018747 in lyx::updateLabels (buf=@0x134cd8d0, childonly=false) at
/Users/sts/Quellen/mac/lyx-devel/src/buffer_funcs.cpp:706
#29 0x0011feb8 in lyx::(anonymous namespace)::textUndoOrRedo (bv=@0x1382b600,
stack=@0x1383a200, otherstack=@0x1383a238) at
/Users/sts/Quellen/mac/lyx-devel/src/Undo.cpp:212
#30 0x001201c8 in lyx::textUndo (bv=@0x1382b600) at
/Users/sts/Quellen/mac/lyx-devel/src/Undo.cpp:241
#31 0x0002d1a3 in lyx::BufferView::dispatch (this=0x1382b600, cmd=@0xbfffe7f4)
at /Users/sts/Quellen/mac/lyx-devel/src/BufferView.cpp:778
#32 0x000ae0df in lyx::LyXFunc::dispatch (this=0x1341cd30, cmd=@0xbfffe7f4) at
/Users/sts/Quellen/mac/lyx-devel/src/LyXFunc.cpp:1783
#33 0x000af483 in lyx::LyXFunc::processKeySym (this=0x1341cd30,
keysym=@0xbfffe8c8, state=ctrl) at
/Users/sts/Quellen/mac/lyx-devel/src/LyXFunc.cpp:378
#34 0x0022388a in lyx::frontend::WorkArea::processKeySym (this=0x134b6404,
key=@0xbfffe928, state=ctrl) at
/Users/sts/Quellen/mac/lyx-devel/src/frontends/WorkArea.cpp:177
#35 0x00236d0a in lyx::frontend::GuiWorkArea::keyPressEvent (this=0x134b63f0,
e=0xbfffed90) at
/Users/sts/Quellen/mac/lyx-devel/src/frontends/qt4/GuiWorkArea.cpp:474

[sts@…]

I forgot: The outline/TOC dock widget must be open.

[sts@…]

Same happens with a math inset.

[sts@…]

First guess: looking at Undo::undoText... updateLabels(*buf) will trigger a TOC
update. The cursor of the bufferview is still broken then. It is only fixed
after that call. But ControlToc::getCurrentTocItem(size_t type) finally (see
backtrace) uses the bufferview cursor for something.

[sts@…]

Fixed in trunk r18762.