diff --git a/ui/views/controls/menu/menu_controller.cc b/ui/views/controls/menu/menu_controller.cc index 10649a65e5290..55e5877099c0d 100644 --- a/ui/views/controls/menu/menu_controller.cc +++ b/ui/views/controls/menu/menu_controller.cc @@ -907,13 +907,19 @@ bool MenuController::OnMousePressed(SubmenuView* source, View* view = forward_to_root->GetEventHandlerForPoint(event_for_root.location()); Button* button = Button::AsButton(view); + // SetHotTrackedButton fires a11y events that can re-enter and delete + // `this` (see crbug.com/443019015 and SetSelection()), so capture a + // WeakPtr before calling it. + base::WeakPtr this_ref = AsWeakPtr(); if (hot_button_ != button) { SetHotTrackedButton(button); + if (!this_ref) { + return true; + } } // Empty menu items are always handled by the menu controller. if (!IsViewClass(view)) { - base::WeakPtr this_ref = AsWeakPtr(); bool processed = forward_to_root->ProcessMousePressed(event_for_root); // This object may be destroyed as a result of a mouse press event (some // item may close the menu).