diff --git a/ui/views/widget/drop_helper.cc b/ui/views/widget/drop_helper.cc index c03265c5a9900..10ec2ad0a0de9 100644 --- a/ui/views/widget/drop_helper.cc +++ b/ui/views/widget/drop_helper.cc @@ -18,6 +18,7 @@ #include "ui/base/dragdrop/os_exchange_data.h" #include "ui/compositor/layer_tree_owner.h" #include "ui/views/view.h" +#include "ui/views/view_tracker.h" #include "ui/views/widget/widget.h" namespace views { @@ -64,8 +65,12 @@ int DropHelper::OnDragOver(const OSExchangeData& data, if (view != target_view_) { // Target changed. Notify old drag exited, then new drag entered. + // The old target's OnDragExited() handler may synchronously destroy the + // view we just selected as the new target, so track it across the + // re-entrant dispatch and re-check liveness before storing/dereferencing. + ViewTracker new_target_tracker(view); NotifyDragExit(); - target_view_ = view; + target_view_ = new_target_tracker.view(); NotifyDragEntered(data, root_view_location, drag_operation); }