[BUG] Chromium renderer crash on Mac

[pavelfeldman]

  0x00000001081f34d9 base::debug::CollectStackTrace(void**, unsigned long) + 9 +105ms
  0x00000001080fd693 base::debug::StackTrace::StackTrace() + 19 +0ms
  0x00000001081f3431 base::debug::(anonymous namespace)::StackDumpSignalHandler(int, __siginfo*, void*) + 1329 +0ms
  0x00007fff682185fd _sigtramp + 29 +2ms
  0x0000000109580ece IPC::(anonymous namespace)::ChannelAssociatedGroupController::SendMessage(mojo::Message*) + 446 +0ms
  0x000000010d2a4324 blink::Document::ColorSchemeChanged() + 164 +1ms
  0x000000010df0b680 blink::Page::InvalidateColorScheme() + 80 +1ms
  0x000000010d98af80 blink::InspectorEmulationAgent::setEmulatedMedia(crdtp::detail::ValueMaybe<WTF::String>, crdtp::detail::PtrMaybe<std::__1::vector<std::__1::unique_ptr<blink::protocol::Emulation::MediaFeature, std::__1::default_delete<blink::protocol::Emulation::MediaFeature> >, std::__1::allocator<std::__1::unique_ptr<blink::protocol::Emulation::MediaFeature, std::__1::default_delete<blink::protocol::Emulation::MediaFeature> > > > >) + 544 +0ms
  0x000000010d98c3b4 blink::InspectorEmulationAgent::disable() + 516 +0ms
  0x000000010d98e3e9 blink::InspectorBaseAgent<blink::protocol::Emulation::Metainfo>::Dispose() + 25 +1ms
  0x000000010d901ae3 blink::DevToolsSession::Detach() + 547 +0ms

upstream: https://bugs.chromium.org/p/chromium/issues/detail?id=1218996

[pavelfeldman]

Steps:

const { chromium } = require('playwright');

(async () => {
  const browser = await chromium.launch({ headless: false });
  const context = await browser.newContext();
  const page = await context.newPage();
  await page.goto('https://alpha.realtor.com/');
  await page.click('[data-testid="input-element"]');
  await page.fill('[data-testid="input-element"]', 'Seattle Hill-Silver Firs, Everett, WA');
  await Promise.all([
    page.waitForNavigation(),
    page.click('[data-testid="s-button"]')
  ]);
  await context.close();
  await browser.close();
})();

[pavelfeldman]

Fixed upstream.