Well, the problem here is that InsetMathChar *explicitly* doesn't
have its buffer_ set. Abdel did this at r23362, with the message:
"We don't want a buffer_ member in InsetMathChar." But I don't know
why we wouldn't. In any event, if one removes the lines he added
there, then the crash goes away. I don't know if this is connected
to the fix at r23363. There isn't all that much in the threads
around that time.
Anyway, I propose to commit the attached and see what happens.
Nice work! I was planning to go back to this, but without any good
starting point.
It looks very good, especially since adding an empty setBuffer does
not remove the buffer_ member which is inherited...
Please apply, and change the assertion from
+ LASSERT(cur.buffer() == &buffer(), return);
to
+ LASSERT(cur.buffer() == buffer_, return);
because buffer() has an assertion of its own.
JMarc
