308414 2026-02-21 21:42:52 -0800 [WebVTT] InbandDataTextTrack::removeCue crashes when removing non-DataCue cues 2026-02-22 15:31:09 -0800 1 1 1 Unclassified WebKit Media WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar, Regression P2 Normal --- 131799 1 ddkilzer ddkilzer webkit-bug-importer oldest_to_newest 2183845 0 ddkilzer 2026-02-21 21:42:52 -0800 `InbandDataTextTrack::removeCue()` crashes when `TextTrack.removeCue()` is called from JavaScript with a non-DataCue on an inband metadata text track. Steps to reproduce: 1. Load HLS media with inband metadata track (creates InbandDataTextTrack) 2. JavaScript: `track.addCue(new VTTCue(0, 1, "test"))` (succeeds) 3. JavaScript: `track.removeCue(vttCue)` (crashes) Crash stack: ``` 0 WebCore WTFCrashWithInfo(int, char const*, char const*, int) [inlined] WebCore WTF::downcast<DataCue, TextTrackCue>(TextTrackCue&) [inlined] WebCore InbandDataTextTrack::removeCue(TextTrackCue&) 1 WebCore jsTextTrackPrototypeFunction_removeCueBody(...) [inlined] WebCore jsTextTrackPrototypeFunction_removeCue(...) 2 JIT (JavaScript execution) [...] ``` Root cause: The function unconditionally performs `downcast<DataCue>(cue)` which triggers `RELEASE_ASSERT(is<DataCue>(cue))`. However, `TextTrack::addCue()` is non-virtual and allows any TextTrackCue subtype to be added to an `InbandDataTextTrack`, creating this mismatch. Regression: This bug has been latent since the original DataCue implementation in April 2014 (commit 150050@main, Bug 131799). <rdar://122375096> 2183847 1 ddkilzer 2026-02-21 22:01:13 -0800 Pull request: https://github.com/WebKit/WebKit/pull/59190 2183946 2 ews-feeder 2026-02-22 15:31:07 -0800 Committed 308019@main (c9e58f72c198): <https://commits.webkit.org/308019@main> Reviewed commits have been landed. Closing PR #59190 and removing active labels.