Due to the way Selection::min/max worked, we were creating backward selections, with cursor < anchor, which was triggering an assert when trying to move cursor back one char when it was already on the first char of the buffer.