Buffer::inset_iterator dereferences to InsetBase &.
In turn, this implies that InsetList can hold only non-zero inset 
pointers. That's not true:

paragraph_funcs.C:

bool moveItem(Paragraph & from, Paragraph & to,
        BufferParams const & params, pos_type i, pos_type j)
{
        ...
                if (from.getInset(i)) {
                        // the inset is not in a paragraph anymore
                        tmpinset = from.insetlist.release(i);
                }

                if (!to.insetAllowed(tmpinset->lyxCode()))
                        return false;
                to.insertInset(j, tmpinset, tmpfont);
}

AFAICS, this is the only instance where InsetList::release is called 
--- why not cull it?

Assuming that it's there for a reason, I don't understand why the code 
doesn't go on to invoke
                        from.insetlist.erase(i);
It seems that the list now contains a null inset pointer for no good 
reason.

Furthermore, there is a leak in the code above. I think the minimal 
change is:

                if (from.getInset(i)) {
                        // the inset is not in a paragraph anymore
                        tmpinset = from.insetlist.release(i);
+                       from.insetlist.erase(i);
                }

-               if (!to.insetAllowed(tmpinset->lyxCode()))
+               if (!to.insetAllowed(tmpinset->lyxCode())) {
+                       delete tmpinset;
                        return false;
+               }
-               to.insertInset(j, tmpinset, tmpfont);
+               if (tmpinset)
+                       to.insertInset(j, tmpinset, tmpfont);

Ie, I think it was wrong in THREE places!

Am I going nuts?

-- 
Angus

Reply via email to