diff --git a/ui/views/widget/widget.cc b/ui/views/widget/widget.cc index 5c01e07d7d605..ee81ed3ded283 100644 --- a/ui/views/widget/widget.cc +++ b/ui/views/widget/widget.cc @@ -1615,10 +1615,18 @@ void Widget::SetCapture(View* view) { } if (!native_widget_->HasCapture()) { + // SetCapture() reaches the platform CaptureClient, which synchronously + // dispatches OnCaptureLost / kMouseCaptureChanged / touch-cancel events to + // other windows. Those handlers may close arbitrary widgets including + // |this|, so guard against use-after-free. + WidgetDeletionObserver widget_deletion_observer(this); native_widget_->SetCapture(); + if (!widget_deletion_observer.IsWidgetAlive()) { + return; + } // Early return if setting capture was unsuccessful. - if (!native_widget_->HasCapture()) { + if (!native_widget_ || !native_widget_->HasCapture()) { return; } }