RenderButton should store its text renderer in a RenderPtr.
Created attachment 220122 [details] Patch
https://searchfox.org/wubkat/source/Source/WebCore/rendering/RenderButton.cpp#101 _____ void RenderButton::setText(const String& str) { if (!m_buttonText && str.isEmpty()) return; if (!m_buttonText) { auto newButtonText = createRenderer<RenderTextFragment>(document(), str); m_buttonText = *newButtonText; // FIXME: This mutation should go through the normal RenderTreeBuilder path. if (RenderTreeBuilder::current()) RenderTreeBuilder::current()->attach(*this, WTFMove(newButtonText)); else RenderTreeBuilder(*document().renderView()).attach(*this, WTFMove(newButtonText)); return; } if (!str.isEmpty()) { m_buttonText->setText(str.impl()); return; } if (RenderTreeBuilder::current()) RenderTreeBuilder::current()->destroy(*m_buttonText); else RenderTreeBuilder(*document().renderView()).destroy(*m_buttonText); } _______ The obsolete patch was modify this above function.
This has already been dealt with by switching over to WeakPtr<RenderTextFragment>.