As you can reproduce with the attached test case, branch crashes if you select all the cells starting from the last cell ending up in the first. The reason is that Cursor::selectionAsString does not handle multiple cell selection and mixes the cursor positions in the starting and ending cells (resulting in pos > endpos).
Trunk doesn't crash, because it handles that case. In the attached patch, I have backported trunk's multi-selection handling as far as possible. However, we do not have a tabular->asString method, and it is not easy to implement that, since it relies on having an InsetCell, which branch hasn't. So I just let Cursor::selectionAsString return an empty docstring() with multi-cell selection. This breaks middle mouse pasting. Is this an acceptable compromise? Jürgen
tabcrash.lyx
Description: application/lyx
Index: src/Cursor.cpp =================================================================== --- src/Cursor.cpp (Revision 26972) +++ src/Cursor.cpp (Arbeitskopie) @@ -1350,6 +1350,21 @@ return docstring(); if (inTexted()) { + idx_type const startidx = selBegin().idx(); + idx_type const endidx = selEnd().idx(); + if (startidx != endidx) { + // multicell selection +#if 0 +// FIXME: we do not have table->asString, thus we have to return docstring() here. + InsetTabular * table = static_cast<InsetTabular*>(&inset()); + BOOST_ASSERT(table); + if (!table) + return docstring(); + table->asString(startidx, endidx); +#endif + return docstring(); + } + Buffer const & buffer = *bv().buffer(); ParagraphList const & pars = text()->paragraphs();