This fixes a use-after-free of a date/time input’s edit-control owner when the input’s type changes during an event. DateTimeEditElement (the shadow element hosting editable date fields) referenced its owner (DateTimeEditElementEditControlOwner, implemented by BaseDateAndTimeInputType) through m_editControlOwner as a plain non-owning CanMakeWeakPtr target, and called back into it directly (didReceiveSpaceKeyFromControl, didBlurFromControl, didChangeValueFromControl, value(), placeholderValue(), localeIdentifier(), isFieldOwnerDisabled/ReadOnly, etc.). If author script changes the input’s type while such an event is being handled (e.g. inside an ‘input’ event handler), the BaseDateAndTimeInputType owner is destroyed as the shadow subtree is rebuilt, while the DateTimeEditElement can still invoke m_editControlOwner — dereferencing a freed owner (use-after-free).

The fix makes DateTimeEditElementEditControlOwner derive from AbstractRefCountedAndCanMakeWeakPtr (so it can be ref-counted and weak-tracked), adds ref()/deref() forwarding on BaseDateAndTimeInputType, and changes every call site to upgrade the weak owner to a RefPtr first (if (RefPtr editControlOwner = m_editControlOwner) …), which both null-checks (owner already gone) and keeps the owner alive across the callback. setupDateTimeChooserParameters also converts an ASSERT(element()) into a real null-check returning false.

The restored invariant is that the shadow edit element never calls into an owner that may have been destroyed; it holds a strong reference across each use. The regression test focuses a date input, types digits so an ‘input’ event fires, and in that handler sets input.type=‘text’ (destroying the date input type), expecting no crash.

A use-after-free in the WebContent process reachable from ordinary HTML/JS by changing a date input’s type during an input/field event. Type-change-during-event UAFs are controllable and groomable; the advisory rates it a crash, but the class is a common route to memory disclosure/corruption and potential code execution in WebContent.