Buffer::inset_iterator dereferences to InsetBase &. In turn, this implies that InsetList can hold only non-zero inset pointers. That's not true:
paragraph_funcs.C: bool moveItem(Paragraph & from, Paragraph & to, BufferParams const & params, pos_type i, pos_type j) { ... if (from.getInset(i)) { // the inset is not in a paragraph anymore tmpinset = from.insetlist.release(i); } if (!to.insetAllowed(tmpinset->lyxCode())) return false; to.insertInset(j, tmpinset, tmpfont); } AFAICS, this is the only instance where InsetList::release is called --- why not cull it? Assuming that it's there for a reason, I don't understand why the code doesn't go on to invoke from.insetlist.erase(i); It seems that the list now contains a null inset pointer for no good reason. Furthermore, there is a leak in the code above. I think the minimal change is: if (from.getInset(i)) { // the inset is not in a paragraph anymore tmpinset = from.insetlist.release(i); + from.insetlist.erase(i); } - if (!to.insetAllowed(tmpinset->lyxCode())) + if (!to.insetAllowed(tmpinset->lyxCode())) { + delete tmpinset; return false; + } - to.insertInset(j, tmpinset, tmpfont); + if (tmpinset) + to.insertInset(j, tmpinset, tmpfont); Ie, I think it was wrong in THREE places! Am I going nuts? -- Angus