bug#62143: 29.0.60; Emacs crashes when selecting a menu displayed by f10 with keyboard (Apple Silicon, M1 MacBookPro)

[Po Lu via "Bug reports for GNU Emacs, the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>]

Hiroya Ebine <hiroya.ebine1@gmail.com> writes:

> 1. Start emacs "$ src/emacs -Q"
> 2. Press f10 (popup menu appeared)
> 3. Press C-n, C-f, Ret (or C-m) in that order
>    (select "Emacs Tutorial")
>
> then emacs crashes.
> Selecting any menu item with the keyboard crashes emacs as well.
> Clicking with the mouse to select a menu item does not cause emacs to crash.
>
>
> ---- report start ----
>
> -------------------------------------
> Translated Report (Full Report Below)
> -------------------------------------
>
> Process:               emacs [88836]
> Path:                  /Users/USER/*/emacs
> Identifier:            emacs
> Version:               ???
> Code Type:             ARM-64 (Native)
> Parent Process:        bash [76302]
> Responsible:           Terminal [1079]
> User ID:               503
>
> Date/Time:             2023-03-12 00:13:32.7562 +0900
> OS Version:            macOS 13.2.1 (22D68)
> Report Version:        12
> Anonymous UUID:        7EA3C70D-4B77-10DE-5C01-C1C12AD45FEC
>
> Sleep/Wake UUID:       6D1A8E7F-81AE-46FF-B424-E8AD0CC5AD15
>
> Time Awake Since Boot: 160000 seconds
> Time Since Wake:       9473 seconds
>
> System Integrity Protection: enabled
>
> Crashed Thread:        0  Dispatch queue: com.apple.main-thread
>
> Exception Type:        EXC_BAD_ACCESS (SIGABRT)
> Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000003
> Exception Codes:       0x0000000000000001, 0x0000000000000003
>
> VM Region Info: 0x3 is not in any region.  Bytes before following
> region: 105553518919677
>       REGION TYPE                    START - END         [ VSIZE]
> PRT/MAX SHRMOD  REGION DETAIL
>       UNUSED SPACE AT START
> --->
>       MALLOC_NANO (reserved)   600018000000-600020000000 [128.0M]
> rw-/rwx SM=NUL  ...(unallocated)
>
> Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
> 0   libsystem_kernel.dylib                   0x19a17a868 __pthread_kill + 8
> 1   libsystem_pthread.dylib                  0x19a1b1cec pthread_kill + 288
> 2   libsystem_c.dylib                        0x19a0b29cc raise + 32
> 3   emacs                                    0x1025e2cf8
> terminate_due_to_signal + 204 (emacs.c:464)
> 4   emacs                                    0x1025e350c emacs_abort +
> 20 (sysdep.c:2313)
> 5   emacs                                    0x1025a17c8
> ns_term_shutdown + 144 (nsterm.m:5765)
> 6   emacs                                    0x102472d00
> shut_down_emacs + 328 (emacs.c:3016)
> 7   emacs                                    0x1025e2cc0
> terminate_due_to_signal + 148 (emacs.c:447)
> 8   emacs                                    0x102498d94
> handle_fatal_signal + 16 (sysdep.c:1783)
> 9   emacs                                    0x102498e10
> deliver_thread_signal + 124 (sysdep.c:1775)
> 10  emacs                                    0x102496e5c
> deliver_fatal_thread_signal + 12 (sysdep.c:1795)
> 11  emacs                                    0x102498e70
> handle_sigsegv + 96 (sysdep.c:1888)
> 12  libsystem_platform.dylib                 0x19a1e02a4 _sigtramp + 56
> 13  emacs                                    0x102406c9c
> find_and_return_menu_selection + 152 (menu.c:981)

What is menu_items at this point?  Could you please step to that frame
in lldb and type:

  (lldb) p menu_items