diff --git a/chrome/renderer/actor/click_dispatcher.cc b/chrome/renderer/actor/click_dispatcher.cc index c0637b7f31f5d..dca24f3215636 100644 --- a/chrome/renderer/actor/click_dispatcher.cc +++ b/chrome/renderer/actor/click_dispatcher.cc @@ -54,8 +54,14 @@ ClickDispatcher::ClickDispatcher( mouse_move.SetPositionInWidget(target.widget_point); // Mouse move is considered optional, so we don't check this result. + // HandleInputEvent runs page script synchronously, which may detach this + // frame and destroy `this`. Guard with a weak self pointer. + auto weak_self = weak_ptr_factory_.GetWeakPtr(); widget->HandleInputEvent( blink::WebCoalescedInputEvent(mouse_move, ui::LatencyInfo())); + if (!weak_self) { + return; + } base::TimeDelta delay = features::kGlicActorMoveBeforeClickDelay.Get(); base::SequencedTaskRunner::GetCurrentDefault()->PostDelayedTask( @@ -102,8 +108,15 @@ void ClickDispatcher::DoMouseDown(WebMouseEvent::Button button, // mouse_event_.SetPositionInScreen(point.x() + offset.x(), // point.y() + offset.y()); + // HandleInputEvent runs page script synchronously (the page's `mousedown` + // listener), which may detach this local-root frame and destroy `this`. + // Guard with a weak self pointer. + auto weak_self = weak_ptr_factory_.GetWeakPtr(); blink::WebInputEventResult result = widget->HandleInputEvent( blink::WebCoalescedInputEvent(mouse_down, ui::LatencyInfo())); + if (!weak_self) { + return; + } if (result == blink::WebInputEventResult::kHandledSuppressed) { Finish(MakeResult(mojom::ActionResultCode::kClickSuppressed, @@ -124,7 +137,12 @@ void ClickDispatcher::DoMouseDown(WebMouseEvent::Button button, } void ClickDispatcher::DoMouseUp() { + // DoMouseUpImpl runs page script synchronously, which may destroy `this`. + auto weak_self = weak_ptr_factory_.GetWeakPtr(); DoMouseUpImpl(); + if (!weak_self) { + return; + } Finish(MakeOkResult()); } @@ -139,9 +157,15 @@ void ClickDispatcher::DoMouseUpImpl() { } mouse_up_event_->SetTimeStamp(ui::EventTimeForNow()); + // HandleInputEvent runs page script synchronously, which may detach this + // frame and destroy `this`. Guard with a weak self pointer. + auto weak_self = weak_ptr_factory_.GetWeakPtr(); blink::WebInputEventResult result = widget->HandleInputEvent(blink::WebCoalescedInputEvent( std::move(*mouse_up_event_), ui::LatencyInfo())); + if (!weak_self) { + return; + } mouse_up_event_.reset(); if (result == blink::WebInputEventResult::kHandledSuppressed) { Finish(MakeResult(mojom::ActionResultCode::kClickSuppressed,