bug#58288: 29.0.50; (flyspell-correct-word-before-point) followed by <down> crashes emacs

[Eli Zaretskii]

> From: Robert Pluim <rpluim@gmail.com>
> Cc: Lars Ingebrigtsen <larsi@gnus.org>,  58288@debbugs.gnu.org,
>   ajd2195@columbia.edu
> Date: Tue, 04 Oct 2022 15:16:43 +0200
> 
> >>>>> On Tue, 04 Oct 2022 15:32:00 +0300, Eli Zaretskii <eliz@gnu.org> said:
> 
>     >> I can reproduce this crash on Macos (but not on Ubuntu) with the 
> current
>     >> "master".
>     >> 
>     >> However, I'm not well versed in debugging stuff like this on Macos, so
>     >> if somebody else could have a look, that'd be great.
> 
>     Eli> If you or someone else could show a meaningful backtrace, maybe the
>     Eli> reason will become evident.
> 
> (this is not current master. I doubt that changes things, but I can
> recompile if needed)
> 
> Process 48138 stopped
> * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS 
> (code=1, address=0x3)
>     frame #0: 0x00000001000743b0 emacs`find_and_return_menu_selection 
> [inlined] AREF(array=<unavailable>, idx=0) at lisp.h:1941:10 [opt]
>    1938       AREF (Lisp_Object array, ptrdiff_t idx)
>    1939       {
>    1940         eassert (0 <= idx && idx < gc_asize (array));
> -> 1941         return XVECTOR (array)->contents[idx];
>    1942       }
>    1943
>    1944       INLINE Lisp_Object *
> Target 0: (emacs) stopped.
> warning: emacs was compiled with optimization - stepping may behave oddly; 
> variables may not be available.
> (lldb) bt
> * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS 
> (code=1, address=0x3)
>   * frame #0: 0x00000001000743b0 emacs`find_and_return_menu_selection 
> [inlined] AREF(array=<unavailable>, idx=0) at lisp.h:1941:10 [opt]
>     frame #1: 0x00000001000743b0 
> emacs`find_and_return_menu_selection(f=0x00000001040cde30, keymaps=false, 
> client_data=0x0000000103071c80) at menu.c:988:17 [opt]
>     frame #2: 0x0000000100249fce emacs`-[EmacsMenu 
> runMenuAt:forFrame:keymaps:](self=0x000060000175d840, _cmd=<unavailable>, 
> p=(x = 86, y = 464), f=0x00000001040cde30, keymaps=false) at nsmenu.m:767:9 
> [opt]

This is in NS-specific code for popup menus.  Sounds like no one is
setting up the menu_items array in that case?