bug#11907: 24.1; Crash under MacOS X

[Konrad Hinsen]

This bug report will be sent to the Bug-GNU-Emacs mailing list
and the GNU bug tracker at debbugs.gnu.org.  Please check that
the From: line contains a valid email address.  After a delay of up
to one day, you should receive an acknowledgement at that address.

Please write in English if possible, as the Emacs maintainers
usually do not have translators for other languages.

Please describe exactly what actions triggered the bug, and
the precise symptoms of the bug.  If you can, give a recipe
starting from `emacs -Q':

Ever since I started to use Emacs 24 (prerelease and now 24.1), I have
experienced spurious crashes. I ended up running Emacs systematically
under debugger control. Today I caught such a crash, so I can provide
a backtrace. This is not reproducible, unfortunately, and happened
while moving the cursor inside an org-mode file.

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: 13 at address: 0x0000000000000000
0x00007fff83b40390 in objc_msgSend_vtable14 ()
(gdb) where
#0  0x00007fff83b40390 in objc_msgSend_vtable14 ()
#1  0x00007fff835b7ab0 in CFRelease ()
#2  0x00007fff83212b6a in TypeManager::Release ()
#3  0x00007fff8321324b in SetPtrData ()
#4  0x00007fff83212fed in MenuElementRow::SetData ()
#5  0x00007fff83214f84 in MenuElementRow::RemoveData ()
#6  0x00007fff83216ea9 in MenuElementRow::RemoveRowData ()
#7  0x00007fff83216e4b in RowStore::RemoveRowData ()
#8  0x00007fff83216ba5 in RowStore::DeleteRows ()
#9  0x00007fff83216b18 in MenuElement::~MenuElement ()
#10 0x00007fff83208a5f in HIObject::HandleClassHIObjectEvent ()
#11 0x00007fff83208916 in HIObject::EventHook ()
#12 0x00007fff83208448 in DispatchEventToHandlers ()
#13 0x00007fff83207a54 in SendEventToEventTargetInternal ()
#14 0x00007fff8320788e in SendEventToEventTargetWithOptions ()
#15 0x00007fff832166c1 in HIObject::Destruct ()
#16 0x00007fff835b7b8f in CFRelease ()
#17 0x00007fff832168ae in MenuData::~MenuData ()
#18 0x00007fff83208a5f in HIObject::HandleClassHIObjectEvent ()
#19 0x00007fff83208916 in HIObject::EventHook ()
#20 0x00007fff83208448 in DispatchEventToHandlers ()
#21 0x00007fff83207a54 in SendEventToEventTargetInternal ()
#22 0x00007fff8320788e in SendEventToEventTargetWithOptions ()
#23 0x00007fff832166c1 in HIObject::Destruct ()
#24 0x00007fff835b7b8f in CFRelease ()
#25 0x00007fff88894b86 in -[NSCarbonMenuImpl _destroyMenuRef] ()
#26 0x00007fff8883974c in -[NSCarbonMenuImpl _destroyMenuRefIfNotCheckedOut] ()
#27 0x00007fff88673eaa in -[NSMenu removeItemAtIndex:] ()
#28 0x00000001001ada47 in -[EmacsMenu clear] (self=0x10112acc0, 
    _cmd=0x108421060) at nsmenu.m:693
#29 0x00000001001b0057 in ns_update_menubar (f=0x7fff5fbfc3a0, 
    deep_p=1606402976, submenu=0x7fff5fbfc3a0) at nsmenu.m:442
#30 0x0000000100037405 in update_menu_bar (f=0x10116eab0, save_match_data=0, 
    hooks_run=1) at xdisp.c:11202
#31 0x000000010003e976 in prepare_menu_bars () at xdisp.c:11080
#32 0x000000010004195e in redisplay_internal () at xdisp.c:12944
#33 0x00000001000c1f4a in read_char (commandflag=1606413936, 
    nmaps=140734799801968, maps=0x7fff5fbfee70, 
    prev_event=5800917795029909504, used_mouse_menu=0x7fff5fbfee70, 
    end_time=0x7fff5fbfee70) at keyboard.c:2448
#34 0x00000001000c4f87 in read_key_sequence () at keyboard.c:2832
#35 0x00000001000c6b1a in command_loop_1 () at keyboard.c:1449
#36 0x000000010012f933 in internal_condition_case (
    bfun=0x1000c5610 <command_loop_1>, handlers=4328590234, 
    hfun=0x1000c6bb0 <cmd_error>) at eval.c:1515
#37 0x00000001000c55ee in command_loop_2 (ignore=140734799802648)
    at keyboard.c:1160
#38 0x000000010012fa38 in internal_catch (tag=140734799802648, 
    func=0x1000c55b0 <command_loop_2>, arg=140734799802648) at eval.c:1272
#39 0x00000001000c7110 in command_loop [inlined] ()
    at /Users/hinsen/Temp/emacs-24.1/src/keyboard.c:1139
#40 0x00000001000c7110 in recursive_edit_1 () at keyboard.c:759
#41 0x00000001000b6ecc in Frecursive_edit () at keyboard.c:823
#42 0x00000001000b3989 in main (argc=33618954, argv=0x7fff5fbff6c0)
    at emacs.c:1715


If Emacs crashed, and you have the Emacs process in the gdb debugger,
please include the output from the following gdb commands:
    `bt full' and `xbacktrace'.
For information about debugging Emacs, please read the file
/Applications/Emacs.app/Contents/Resources/etc/DEBUG.


In GNU Emacs 24.1.1 (x86_64-apple-darwin11.4.0, NS apple-appkit-1138.47)
 of 2012-07-05 on Konrad-Hinsens-MacBook-Pro.local
Windowing system distributor `Apple', version 10.3.1138
Configured using:
 `configure '--with-ns''

Important settings:
  value of $LC_ALL: en_US.UTF-8
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: fr_FR.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Org

Minor modes in effect:
  global-auto-revert-mode: t
  auto-revert-mode: t
  org-indent-mode: t
  recentf-mode: t
  show-paren-mode: t
  shell-dirtrack-mode: t
  diff-auto-refine-mode: t
  global-undo-tree-mode: t
  undo-tree-mode: t
  yas/global-mode: t
  yas/minor-mode: t
  whitespace-newline-mode: t
  whitespace-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  visual-line-mode: t
  transient-mark-mode: t

Recent input:
q M-x r e p o r t - e m <tab> <return>

Recent messages:
File /Volumes/NO NAME/PALM/Launcher/God's Debris.pdb removed from the recentf 
list
File /Volumes/NO NAME/PALM/Launcher/ComputerNotes.pdb removed from the recentf 
list
File /Volumes/NO NAME/.fseventsd/fseventsd-uuid removed from the recentf list
File /Volumes/NO NAME/TEXTFILES/test removed from the recentf list
Cleaning up the recentf list...done (5 removed)
Loading /Users/hinsen/.emacs.d/config/user-interface.el (source)...done
Loading /Users/hinsen/.emacs.d/custom.el (source)...done
Loading vc-hg...done
OVERVIEW [5 times]
For information about GNU Emacs and the GNU system, type C-h C-a.

Load-path shadows:
~/.emacs.d/lisp/org-vm hides 
/Applications/Emacs.app/Contents/Resources/lisp/org/org-vm
~/.emacs.d/lisp/org-eshell hides 
/Applications/Emacs.app/Contents/Resources/lisp/org/org-eshell

Features:
(shadow flyspell ispell vm-rfaddons vm-menu vm-window vm-toolbar
vm-virtual vm-summary-faces vm-mouse vm-page pp vm emacsbug
org-colview solar cal-dst holidays hol-loaddefs diary-lib
diary-loaddefs cal-iso vc-hg autorevert disp-table org-indent server
recentf tree-widget paren uniquify ido windmove ein french-holidays
org-crypt org-w3m org-jsinfo org-infojs org-html org-exp ob-exp
org-exp-blocks find-func org-agenda org-info org-eshell org-docview
org-bibtex bibtex ob-ditaa ob-clojure ob-haskell ob-js ob-python
ob-ruby ob-perl ob-R ob-sh shell ace-jump-mode magithub json url
url-proxy url-privacy url-expand url-methods url-history url-cookie
url-util url-parse url-vars mailcap magit diff-mode log-edit pcvs-util
add-log magit-key-mode monky help-mode view dired+ dired-x ediff-merg
ediff-diff ediff-wind ediff-mult ediff-help ediff-init ediff-util
dired-aux undo-tree yasnippet julia-mode gnuplot info-look bbdb-vm
vm-mime vm-undo vm-message vm-macro bbdb-snarf mail-extr bbdb-com
bbdb-autoloads bbdb org-vm org ob-emacs-lisp ob-tangle ob-ref ob-lob
ob-table org-footnote org-src ob-comint ob-keys ob ob-eval
org-pcomplete pcomplete org-list org-faces org-compat org-entities
org-macs noutline outline easy-mmode cal-menu calendar cal-loaddefs
warnings advice advice-preload vm-reply vm-motion vm-summary vm-folder
vm-minibuf vm-misc vm-pcrisis vm-autoloads vm-version vm-vars mu4e
mu4e-speedbar speedbar sb-image ezimage dframe mu4e-main mu4e-view
comint ansi-color mu4e-headers mu4e-compose mu4e-actions smtpmail
auth-source eieio byte-opt bytecomp byte-compile cconv macroexp assoc
gnus-util password-cache sendmail message format-spec rfc822 mml
mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231 rfc2047
rfc2045 ietf-drums mm-util mail-prsvr mailabbrev mail-utils gmm-utils
mailheader mu4e-mark mu4e-proc mu4e-utils doc-view jka-compr
image-mode html2text mu4e-vars hl-line mu4e-meta paredit edmacro
kmacro em-smart ring esh-var esh-io esh-cmd esh-ext esh-proc esh-arg
eldoc help-fns esh-groups eshell esh-module esh-mode esh-util
find-dired dired regexp-opt color-theme wid-edit w3m-load browse-url
auctex-autoloads tex-site clojure-test-mode-autoloads
clojure-mode-autoloads color-theme-actress-autoloads
color-theme-zenburn-autoloads color-theme-autoloads gnuplot-autoloads
go-mode-autoloads ipython-autoloads magithub-autoloads finder-inf
magit-autoloads markdown-mode-autoloads marmalade-autoloads
furl-autoloads monky-autoloads info oauth2-autoloads paredit-autoloads
python-mode-autoloads python-pep8-autoloads python-pylint-autoloads
slime-autoloads yasnippet-autoloads package tabulated-list timezone
whitespace cl filesets easymenu time-date tooltip ediff-hook vc-hooks
lisp-float-type mwheel ns-win tool-bar dnd fontset image fringe
lisp-mode register page menu-bar rfn-eshadow timer select scroll-bar
mouse jit-lock font-lock syntax facemenu font-core frame cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese case-table epa-hook jka-cmpr-hook help simple abbrev
minibuffer loaddefs button faces cus-face files text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote make-network-process dbusbind ns
multi-tty emacs)