This is in radar as <rdar://problem/11766518> PageClientImpl registers entries on the undo stack, but does not guarantee that all such entries will be removed from the undo stack before the PageClientImpl is dealloc'ed. This leads to some code paths in which a bad undo target can be left on the undo stack, leading to a crash when Undo is then performed.
Created attachment 150034 [details] Patch that clears Undo actions when the WKView moves to another window (including the nil window)
Comment on attachment 150034 [details] Patch that clears Undo actions when the WKView moves to another window (including the nil window) Looks good to me
This was committed in <http://trac.webkit.org/changeset/121482>.