Turns out we shouldn't implement nsMenuX::RemoveItem. Carbon widgets don't implement it either. This fixes a major crash in Cocoa menus. no bug.

widget/src/cocoa/nsMenuX.mm

@@ -309,18 +309,7 @@ NS_IMETHODIMP nsMenuX::InsertItemAt(const PRUint32 aPos, nsISupports * aMenuItem
 
 NS_IMETHODIMP nsMenuX::RemoveItem(const PRUint32 aPos)
 {
-  if (mMacMenu != NULL) {
+  NS_WARNING("Not implemented");
-    // clear command id
-    nsCOMPtr<nsIMenuCommandDispatcher> dispatcher(do_QueryInterface(mManager));
-    if (dispatcher) {
-      dispatcher->Unregister((PRUint32)[[mMacMenu itemAtIndex:aPos] tag]);
-    }
-    // get rid of Cocoa menu item
-    [mMacMenu removeItemAtIndex:aPos];
-  }
-  // get rid of Gecko menu items
-  mMenuItemsArray.RemoveObjectAt(aPos);
-
   return NS_OK;
 }