I just got the following crash while working with lates 1.4.2svn: I use character styles; I marked a bold word in a tabular cell and hit Insert->Character Style. Immediately LyX asserted. This happened several times, though I didn't manage yet to get a minimal test scenario.
FWIW, backtrace is below. Jürgen Assertion triggered in const LyXFont Paragraph::getFontSettings(const BufferParams&, lyx::pos_type) const by failing check "pos <= size()" in file paragraph.C:302 Program received signal SIGABRT, Aborted. [Switching to Thread -1222146384 (LWP 7914)] 0xffffe410 in __kernel_vsyscall () (gdb) bt #0 0xffffe410 in __kernel_vsyscall () #1 0xb72a87d0 in raise () from /lib/libc.so.6 #2 0xb72a9ea3 in abort () from /lib/libc.so.6 #3 0x084d42c3 in lyx::support::abort () at abort.C:22 #4 0x080bcf58 in boost::assertion_failed (expr=0x854cfed "pos <= size()", function=0x854d560 "const LyXFont Paragraph::getFontSettings(const BufferParams&, lyx::pos_type) const", file=0x854cfe1 "paragraph.C", line=302) at boost.C:56 #5 0x081acfb0 in Paragraph::getFontSettings (this=0x889b140, [EMAIL PROTECTED], pos=1) at paragraph.C:302 #6 0x081aecfe in Paragraph::getFont (this=0x889b140, [EMAIL PROTECTED], pos=1, [EMAIL PROTECTED]) at paragraph.C:378 #7 0x08102a3a in LCursor::getFont (this=0x87d7b48) at cursor.C:1232 #8 0x0806569b in BufferView::Pimpl::fitCursor (this=0x87d7a68) at BufferView_pimpl.C:649 #9 0x08067887 in BufferView::Pimpl::update (this=0x87d7a68, flags=3) at BufferView_pimpl.C:698 #10 0x08063918 in BufferView::update (this=0x873b630, flags=3) at BufferView.C:145 #11 0x0816078b in LyXFunc::dispatch (this=0x873b328, [EMAIL PROTECTED]) at lyxfunc.C:1597 #12 0x0830999f in LyXView::dispatch (this=0x87c54d0, [EMAIL PROTECTED]) at LyXView.C:202 #13 0x081f23ed in (anonymous namespace)::doInsertInset ([EMAIL PROTECTED], text=0x889b030, [EMAIL PROTECTED], edit=true, pastesel=true) at text3.C:263 #14 0x081f968d in LyXText::dispatch (this=0x889b030, [EMAIL PROTECTED], [EMAIL PROTECTED]) at text3.C:1191 #15 0x082e14b5 in InsetText::doDispatch (this=0x889b008, [EMAIL PROTECTED], [EMAIL PROTECTED]) at insettext.C:272 #16 0x0827c7a6 in InsetBase::dispatch (this=0x889b008, [EMAIL PROTECTED],