diff --git a/xfa/fwl/cfwl_caret.cpp b/xfa/fwl/cfwl_caret.cpp index 8aef853f6..665504b13 100644 --- a/xfa/fwl/cfwl_caret.cpp +++ b/xfa/fwl/cfwl_caret.cpp @@ -32,6 +32,15 @@ CFWL_Caret::CFWL_Caret(CFWL_App* app, CFWL_Caret::~CFWL_Caret() = default; +void CFWL_Caret::PreFinalize() { + // Deregister the embedder timer at PreFinalize time, not in the destructor. + // The cppgc heap sweeps incrementally, so the destructor may run long after + // this object's payload (and that of `outer_`) has been poisoned/reclaimed, + // letting an embedder timer fire OnTimerFired() on a dead widget. + timer_.reset(); + CFWL_Widget::PreFinalize(); +} + FWL_Type CFWL_Caret::GetClassID() const { return FWL_Type::Caret; } diff --git a/xfa/fwl/cfwl_caret.h b/xfa/fwl/cfwl_caret.h index e2626ed40..939515456 100644 --- a/xfa/fwl/cfwl_caret.h +++ b/xfa/fwl/cfwl_caret.h @@ -21,6 +21,7 @@ class CFWL_Caret final : public CFWL_Widget, public CFX_Timer::CallbackIface { ~CFWL_Caret() override; // CFWL_Widget: + void PreFinalize() override; FWL_Type GetClassID() const override; void DrawWidget(CFGAS_GEGraphics* pGraphics, const CFX_Matrix& matrix) override; diff --git a/xfa/fwl/cfwl_scrollbar.cpp b/xfa/fwl/cfwl_scrollbar.cpp index bb8145d94..4c0ba4ef9 100644 --- a/xfa/fwl/cfwl_scrollbar.cpp +++ b/xfa/fwl/cfwl_scrollbar.cpp @@ -34,6 +34,15 @@ CFWL_ScrollBar::CFWL_ScrollBar(CFWL_App* app, CFWL_ScrollBar::~CFWL_ScrollBar() = default; +void CFWL_ScrollBar::PreFinalize() { + // Deregister the embedder timer at PreFinalize time, not in the destructor. + // The cppgc heap sweeps incrementally, so the destructor may run long after + // this object's payload (and that of `outer_`) has been poisoned/reclaimed, + // letting an embedder timer fire OnTimerFired() on a dead widget. + timer_.reset(); + CFWL_Widget::PreFinalize(); +} + FWL_Type CFWL_ScrollBar::GetClassID() const { return FWL_Type::ScrollBar; } diff --git a/xfa/fwl/cfwl_scrollbar.h b/xfa/fwl/cfwl_scrollbar.h index 41d71374d..b01d78973 100644 --- a/xfa/fwl/cfwl_scrollbar.h +++ b/xfa/fwl/cfwl_scrollbar.h @@ -29,6 +29,7 @@ class CFWL_ScrollBar final : public CFWL_Widget, ~CFWL_ScrollBar() override; // CFWL_Widget: + void PreFinalize() override; FWL_Type GetClassID() const override; void Update() override; void DrawWidget(CFGAS_GEGraphics* pGraphics,