There is a use-after-free in the TextField thickness setter. If the thickness parameter is an object with valueOf set to a function which frees the TextField parent, it is used after it is freed.
e4ff4a515fcc1862e4b29c13c2a15404c86f2cea6d2fa31892a1c1a54d5ba8da