[Crash] segv, key_matches_specifier_p, popup menu in Gnus/Tm

This has happened to me three times now. I finally sent a signal and got a core file. I was reading email with Gnus, in which Tm is installed via `mime-setup', and tried to middle click on a URL in the message body. I have a two button pad thing embedded on the keyboard, and have it set up so I both-click to get middle click. I fumbled, and got right-click instead, which popped up the menus. It's a three item menu with a title and three submenus. Neither clicking outside the popup menu nor on the title would lower the menu. Clicking on a submenu would pop up the submenu, but nothing in that submenu could be selected. When I sent a SIGINT, with the top submenu open, it blonked, popped down just the submenu, and printed an error message about wto, character-p, the name of the menu item. (It's the same error I get when I try to use keyboard shortcuts for menus. Did I report that one yet? I cannot recall.) I sent another SIGINT, and it dumped core. I don't have any configurations in my init.el that would affect this... I remove a few menu entries and add one, but to the global menubar. I don't have the accelerators configured, nor have I renamed the menus... due to the wto bug I just mentioned. I have noticed before, since as long as I can remember, that some popup menus pop down when I click outside of them, but others require that I click their title. They all ought to work the same; when I click outside of them, they ought to pop down. Otherwise, the WM might raise the frame above the menu, which has grabbed and can no longer take input. (One version of a Netscape Beta had that bug.) uname -a: Linux bittersweet 2.2.13 #4 Mon Jan 3 16:02:57 PST 2000 i586 unknown /usr/local/src/PKG/unstable/main/xemacs/xemacs-21.2/configure '--srcdir=/usr/local/src/PKG/unstable/main/xemacs/xemacs-21.2' '--prefix=/usr' '--without-prefix' '--cflags=-mcpu=k6 -march=k6 -ggdb -O3' '--with-database=berkdb' '--with-athena=xaw3d' '--with-widgets=athena' '--with-modules' '--package-path=/usr/local/src/XEmacs/packages' '--infopath=/usr/share/info:/usr/local/share/info:/usr/info:/usr/local/info' '--with-mule=no' '--with-file-coding' 'i686-bittersweet-linux' XEmacs 21.2-b26 "Millenium" configured for `i686-bittersweet-linux'. Where should the build process find the source code? /usr/local/src/PKG/unstable/main/xemacs/xemacs-21.2 What installation prefix should install use? /usr What operating system and machine description files should XEmacs use? `s/linux.h' and `m/intel386.h' What compiler should XEmacs be built with? gcc -mcpu=k6 -march=k6 -ggdb -O3 Should XEmacs use the GNU version of malloc? yes (Using Doug Lea's new malloc from the GNU C Library.) Should XEmacs use the relocating allocator for buffers? yes What window system should XEmacs use? x11 Where do we find X Windows header files? /usr/X11R6/include Where do we find X Windows libraries? /usr/X11R6/lib Compiling in support for XAUTH. Compiling in support for XPM images. Compiling in support for PNG image handling. Compiling in support for (builtin) GIF image handling. Compiling in support for JPEG image handling. Compiling in support for TIFF image handling. Compiling in support for X-Face message headers. Compiling in native sound support. Compiling in support for Enlightened Sound Daemon (ESD). Compiling in support for Berkeley DB. Compiling in support for LDAP. Compiling in support for ncurses. Compiling in support for GPM (General Purpose Mouse). Compiling in File coding support. Compiling in support for proper WM_COMMAND handling. Using Lucid menubars. Using Lucid scrollbars. Using Athena native widgets. Using Athena dialog boxes. Compiling in dynamic shared object module support. movemail will use "dot-locking" for locking mail spool files. Compiling in extra code for debugging. WARNING: --------------------------------------------------------- WARNING: Compiling in support for runtime error checking. WARNING: XEmacs will run noticeably more slowly as a result. WARNING: Error checking is on by default for XEmacs beta releases. WARNING: --------------------------------------------------------- Here's a screenlog showing the `gdb' "where" output.