[Problem/Bug]: Browser process crashes in context menu with custom menu items

What happened?

• An item with an icon is added to the browser context menu when the context menu is triggered for the first time.
• A different item with an icon is added to the browser context menu when the context menu is triggered for the second time.
• Context menu is triggered for a misspelled word.
• Several blank items are displayed instead of the spelling suggestions.
• When the last blank item is clicked, the browser process crashes.

The crash does not occur and no blank spelling suggestions are displayed if no icons are supplied for the custom menu items.

Failed workarounds

• Crash occurs with icons loaded from assembly resources or files.
• Crash occurs with icons copied to a dedicated per-item MemoryStream.

See https://github.com/seldoff/WebView2Samples/tree/menu-crash/SampleApps/WebView2WpfBrowser project for a repro code. The code that adds offending menu items is in the MainWindow.WebView_ContextMenuRequested method.

Importance

Important. My app's user experience is significantly compromised.

Runtime Channel

Stable release (WebView2 Runtime)

Runtime Version

125.0.2535.85

SDK Version

1.0.2535.41

Framework

WPF

Operating System

Windows 10, Windows 11

OS Version

22631.3593

Repro steps

Use the WebView2WpfBrowser sample project from https://github.com/seldoff/WebView2Samples/blob/menu-crash/SampleApps/WebView2WpfBrowser.

1. Start the app, it navigates to https://www.w3schools.com/tags/tryit.asp?filename=tryhtml_textarea.
2. Replace text in the text box in the right panel with a misspelled word: "tesst".
   
3. Right-click on the misspelled word. The context menu with a spelling suggestion is displayed.
   
4. Right-click on the misspelled word again. The context menu with three empty suggestions is displayed.

5. Click on the third empty suggestion. The browser process crashes.

Repros in Edge Browser

No, issue does not reproduce in the corresponding Edge version

Regression

Don't know

Last working version (if regression)

No response

Start with the SampleApps/WebView2WpfBrowser project and MainWindow.xaml.cs, especially MainWindow.WebView_ContextMenuRequested. Reproduce the two context-menu openings on the misspelled word with icon-bearing custom items. Done means the second menu has no blank spelling suggestions and clicking its items does not crash the browser process.