InDesign Server 2026 crashes merging table cells with the World-Ready Composer

Versions tested: InDesign Server 2026 21.3.0, 21.5.1 and 21.6.0 on Windows Server 2022.

To reproduce, run crash_demo.jsx on a freshly started server.

The script creates a new document with a 2x2 table, puts some text in a cell and sets that text
to the Adobe World-Ready Paragraph Composer. It then reads story.overflows and merges the two
cells in the second row.

Expected: the script finishes.
Actual: the server process crashes (0xC0000005 in Public.dll).

The script finishes normally if:
- worldReady is set to false at the top of the script
- the story.overflows line is removed
- it is run in InDesign 2026 desktop (21.6)

Assigning destinationText on a hyperlink text destination in the same cell crashes the same way.

This stops us rendering documents in languages that need the World-Ready Composer.

-- crash_demo.jsx:

// Crashes InDesign Server 2026 (21.3). Set worldReady to false and it runs fine.
var worldReady = true;

var doc = app.documents.add();
var page = doc.pages[0];
var frame = page.textFrames.add();
frame.geometricBounds = page.bounds;
var story = frame.parentStory;

var table = story.insertionPoints[-1].tables.add({ bodyRowCount: 2, columnCount: 2 });
var cell = table.rows[0].cells[0];
cell.contents = "Some text";
if (worldReady) {
cell.texts[0].composer = "$ID/HL Composer Optyca";
}

// Reading this composes the story
var overflows = story.overflows;

// The server crashes here
table.rows[1].cells[0].merge(table.rows[1].cells[1]);

doc.close(SaveOptions.NO);
"No crash";

--crashdemodestination.jsx:

// Crashes InDesign Server 2026 (21.3). Set worldReady to false and it runs fine.
var worldReady = true;

var doc = app.documents.add();
var page = doc.pages[0];
var frame = page.textFrames.add();
frame.geometricBounds = page.bounds;
var story = frame.parentStory;

var table = story.insertionPoints[-1].tables.add({ bodyRowCount: 2, columnCount: 2 });
var cell = table.rows[0].cells[0];
cell.contents = "Some text";
if (worldReady) {
cell.texts[0].composer = "$ID/HL Composer Optyca";
}

var destination = doc.hyperlinkTextDestinations.add(cell.insertionPoints[-1]);

// Reading this composes the story
var overflows = story.overflows;

// The server crashes here, even though this assigns the value it already has
destination.destinationText = destination.destinationText;

doc.close(SaveOptions.NO);
"No crash";