The following patch fixes the crash described in the bug: popRight should not blindly go one step on the right, since notifyCursorLeave may cause a script inset to commit suicide. The situation is still not perfect if the nucleus contained more than one character, but I think it will have to do for now.
I'll commit tomorrow if nobody complains. JMarc
Index: src/cursor.C =================================================================== --- src/cursor.C (revision 16397) +++ src/cursor.C (working copy) @@ -364,7 +364,8 @@ bool LCursor::popRight() if (depth() == 1) return false; pop(); - ++pos(); + if (pos() < lastpos()) + ++pos(); return true; }