bug#7190: Crash in menus on w32

[Eli Zaretskii]

> From: Lennart Borgman <lennart.borgman@gmail.com>
> Date: Tue, 19 Oct 2010 02:20:42 +0200
> Cc: 7190@debbugs.gnu.org
> 
> >          entry = AREF (vector, i + MENU_ITEMS_ITEM_VALUE);
> >
> > retrieves the selected menu item, and `vector' is the entire menu bar,
> > computed as
> >
> >  vector = f->menu_bar_vector;
> >
> > See frame.h for the structure of this vector.
> >
> > By looking at `entry' you can find which menu item is being selected.
> >
> > Then in w32_free_submenu_strings, you can see the same info in its
> > bare C form.
> 
> I just got a new crash, but unfortunately I have still not understand
> how to look at those values.

Please be specific: what parts in the explanation above you don't
understand?  I don't know how to answer a question "I don't understand
how to do X", when I already explained how to do it.

> With "bt full"

"bt full" is useless in this case, because the problem is a corruption
of the heap.  We need to establish which menu item(s) are corrupted,
and the information about that is not in local variables displayed by
"bt full", it's in the data structures manipulated by
w32_free_submenu_strings and w32_free_menu_strings.  I gave you above
the way to start looking at these data structures.  Please try using
that as the starting point, and if the problem is not immediately
obvious, come back and report your findings.