There is a use-after-free in the TextField gridFitType setter. If it is set to an object with a toString method that frees the TextField, the property will be written after it is freed.
1d54659faa27363193dfbcb808bc3e21e30077689df66a670c2377623bb176bb