In case the domain on a reference field has been computed by the domain inversion process a crash will occurs because the search reference a field that might not exist in the model.

Here's the traceback I got when reproducing it on a toy module made on purpose.

68158 140009424287488 [2021-01-13 18:05:52,487] ERROR trytond.protocols.dispatcher <class 'trytond.ir.ui.menu.UIMenu'>.search(*(['AND', ['reference', '=', 'ir.ui.menu,50'], ['reference', '=', 'ir.ui.menu,50']], 0, 1000, None, {'client': 'd5e8f533-1abe-4487-a854-5977db4b94fc', 'language': 'en', 'language_direction': 'ltr', 'groups': [1]}), **{}) from <admin@127.0.0.1>/reference_domain/
Traceback (most recent call last):
  File "/home/nicoe/projets/tryton/tryton-env/RefrenceFieldDomain/trytond/trytond/protocols/dispatcher.py", line 181, in _dispatch
    result = rpc.result(meth(*c_args, **c_kwargs))
  File "/home/nicoe/projets/tryton/tryton-env/RefrenceFieldDomain/trytond/trytond/ir/ui/menu.py", line 134, in search
    menus = super(UIMenu, cls).search(domain, offset=offset, limit=limit,
  File "/home/nicoe/projets/tryton/tryton-env/RefrenceFieldDomain/trytond/trytond/model/modelsql.py", line 1263, in search
    tables, expression = cls.search_domain(domain)
  File "/home/nicoe/projets/tryton/tryton-env/RefrenceFieldDomain/trytond/trytond/model/modelsql.py", line 1449, in search_domain
    expression = convert(domain)
  File "/home/nicoe/projets/tryton/tryton-env/RefrenceFieldDomain/trytond/trytond/model/modelsql.py", line 1446, in convert
    return And((convert(d) for d in (
  File "/home/nicoe/projets/tryton/tryton-env/RefrenceFieldDomain/trytond/trytond/model/modelsql.py", line 1446, in <genexpr>
    return And((convert(d) for d in (
  File "/home/nicoe/projets/tryton/tryton-env/RefrenceFieldDomain/trytond/trytond/model/modelsql.py", line 1436, in convert
    field = cls._fields[fname]
KeyError: 'reference'

What happens is that the domain sent by the client do not take into account the fact that it will make a search on the model selected in the reference field. Thus the domain should not be ['reference', '=', 'ir.ui.menu,50'] but ['id', '=', 50] (note also that the clause is repeated which I did not investigate yet).