I've got a patch in the upstream bug for comment. I'm going to mark the similar bugs as duplicates. Which might be a heavy hammer. But there are many ways to get to the same crash here, which seem to be having nested ui manager updates, which causes memory to be freed twice in a couple ways.
If after patching, we still see some similar-but-not-quite crashes, we can investigate those separately.
I've got a patch in the upstream bug for comment. I'm going to mark the similar bugs as duplicates. Which might be a heavy hammer. But there are many ways to get to the same crash here, which seem to be having nested ui manager updates, which causes memory to be freed twice in a couple ways.
If after patching, we still see some similar- but-not- quite crashes, we can investigate those separately.