Please provide example stack from gdb.

Confirmed. Aqua menus enabled via environment variable. Started from Terminal.

From the crash report:
Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x199ffffc

Thread 0 Crashed:
0   <<00000000>> 	0xffff0b3c __memcpy + 924 (cpu_capabilities.h:228)
1   libvcl680mxi.dylib             	0x0122f21b AquaSalBitmap::Create(unsigned
long, unsigned long, unsigned short, unsigned long, unsigned char*, unsigned
long, unsigned long, unsigned long, unsigned long) + 145
2   libvcl680mxi.dylib             	0x0122f2d5 AquaSalBitmap::Create(CGContext*,
int, int, int, int) + 131
3   libvcl680mxi.dylib             	0x0122b845 AquaSalGraphics::getBitmap(long,
long, long, long) + 93
4   libvcl680mxi.dylib             	0x0122b699
AquaSalGraphics::copyBits(SalTwoRect const*, SalGraphics*) + 55
5   libvcl680mxi.dylib             	0x0112bec5 SalGraphics::CopyBits(SalTwoRect
const*, SalGraphics*, OutputDevice const*, OutputDevice const*) + 51
6   libvcl680mxi.dylib             	0x01095080
OutputDevice::ImplDrawOutDevDirect(OutputDevice const*, void*) + 432
7   libvcl680mxi.dylib             	0x0109c141 OutputDevice::DrawOutDev(Point
const&, Size const&, Point const&, Size const&, OutputDevice const&) + 893
8   libsvx680mxi.dylib             	0x21729d94
sdr::overlay::OverlayManagerBuffered::ImpBufferTimerHandler(AutoTimer*) + 834
9   libvcl680mxi.dylib             	0x01018bfe Timer::Timeout() + 28
10  libvcl680mxi.dylib             	0x01018dc2 Timer::ImplTimerCallbackProc() + 112
11  libvcl680mxi.dylib             	0x01223af8
HandleOOoSalTimerEvent(OpaqueEventHandlerCallRef*, OpaqueEventRef*, void*) + 88
12  com.apple.HIToolbox            	0x92f017eb
DispatchEventToHandlers(EventTargetRec*, OpaqueEventRef*, HandlerCallRec*) + 1093
13  com.apple.HIToolbox            	0x92f00e90
SendEventToEventTargetInternal(OpaqueEventRef*, OpaqueEventTargetRef*,
HandlerCallRec*) + 304
14  com.apple.HIToolbox            	0x92f00d55 SendEventToEventTargetWithOptions
+ 55
15  com.apple.HIToolbox            	0x92f0825d
ToolboxEventDispatcherHandler(OpaqueEventHandlerCallRef*, OpaqueEventRef*,
void*) + 357
16  com.apple.HIToolbox            	0x92f01ba2
DispatchEventToHandlers(EventTargetRec*, OpaqueEventRef*, HandlerCallRec*) + 2044
17  com.apple.HIToolbox            	0x92f00e90
SendEventToEventTargetInternal(OpaqueEventRef*, OpaqueEventTargetRef*,
HandlerCallRec*) + 304
18  com.apple.HIToolbox            	0x92f080f0 SendEventToEventTarget + 56
19  libvcl680mxi.dylib             	0x0122ffff AquaSalInstance::Yield(bool,
bool) + 121
20  libvcl680mxi.dylib             	0x01224c2a
HandleWindowBoundsChangedEvent(OpaqueEventHandlerCallRef*, OpaqueEventRef*,
void*) + 96
21  com.apple.HIToolbox            	0x92f017eb
DispatchEventToHandlers(EventTargetRec*, OpaqueEventRef*, HandlerCallRec*) + 1093
22  com.apple.HIToolbox            	0x92f00e90
SendEventToEventTargetInternal(OpaqueEventRef*, OpaqueEventTargetRef*,
HandlerCallRec*) + 304
23  com.apple.HIToolbox            	0x92f00d55 SendEventToEventTargetWithOptions
+ 55



From the terminal output:
>*>_> GetKeyName
>*>_> SetAccelerator
>*>_> SetItemImage
>*>_> SetItemImage
>*>_> SetItemImage
>*>_> SetItemImage
>*>_> SetItemImage
>*>_> GetKeyName
>*>_> SetAccelerator
>*>_> DrawMenuBar
Control type is : 100
Control part is : 1
Control type is : 100
Control part is : 1
>*>_> PostEvent
Control type is : 100
Control part is : 1
Control type is : 100
Control part is : 1
To return: 0
Bounds changed event
shaun-mcdonalds-computer:~/Applications/OpenOffice.org 2.1.app/Contents/MacOS
shaunmcdonald$ 

This bug is probably for Ismael...

Setting keyword

ericb->isma87 

Calc works on m200 + aquavcl01 without bitmaps changes. 

I'll apply them and I'll try to see where/what causes the instant crashes

Ismael advised me to add if (!some_Context ) inside AquaSalBitmap:::Create() 
And I now can use Calc without crash, using native menus and masked bitmaps.

The issues is caused by NULL context is passed by reference in another function.

The solution should IMHO consist in find the caller(s) and protect the call to AquaSalBitmap:::Create
(CGContextRef xContext, int nX, int nY, int nWidth, int nHeight) when NULL context is passes by 
reference 

ericb->isma87

I'll attach my changes, but this is issue is for you. ( I just need a fix for Solutions Linux Expo )

Created attachment 42524 [details]
patch to add in Ismael patches for bitmaps

Just verify mrBitmapContext is not NULL seems to fix a lot of problems

Please forget the previous patch, completely wrong

Investigating more (using gdb) , it appears copyBits() returns negative values for bitmaps dimensions.

So as uggly workaround, I have tested nDX and nDY signs, and it works. No idea why negative values are 
returned. To be continued

Please test the attached patch, to confirm/verify this is really nDX and nDY values causing the crash

Created attachment 42531 [details]
patch to verify the cause of Calc crashes

Adding to Meta Issue.

patch committed
Issue marked as fixed

ericb->isma87

Issue verified fixed for me :  all the crashes I experimented with Calc do not occur anymore.

- Calc can now be used even with native menus
- I can divide the sheet in 4 areas, and I don't see crashes like before ( I'll attach a screenshot )

Thank you very much Ismael !

Created attachment 43141 [details]
No more crashes with Calc after dividing the sheet in 4 parts

Set target to 2.3.

Tested with SRC680_m220

Calc sheet /  dividing in 4 parts + trace diagrams .. etc

No more crashes,  as expected  -> closing