diff --git a/third_party/blink/renderer/platform/widget/widget_base.cc b/third_party/blink/renderer/platform/widget/widget_base.cc
index 0000000000..0000000000 100644
--- a/third_party/blink/renderer/platform/widget/widget_base.cc
+++ b/third_party/blink/renderer/platform/widget/widget_base.cc
@@ -1440,12 +1440,21 @@ void WidgetBase::UpdateCompositionInfo(bool immediate_request) {
   TRACE_EVENT0("renderer", "WidgetBase::UpdateCompositionInfo");
   gfx::Range range;
   Vector<gfx::Rect> character_bounds;

   if (GetTextInputType() == ui::TextInputType::TEXT_INPUT_TYPE_NONE) {
     // Composition information is only available on editable node.
     range = gfx::Range::InvalidRange();
   } else {
+    // GetCompositionRange()/GetCompositionCharacterBounds() force synchronous
+    // layout via Document::UpdateStyleAndLayout(). The PluginDisposeSuspendScope
+    // destructor at the end of layout can dispose plugins which are permitted to
+    // run script (ScriptForbiddenScope::AllowUserAgentScript). That script may
+    // detach a local-root subframe, which synchronously calls
+    // WebFrameWidgetImpl::Close -> widget_base_.reset(), freeing |this|.
+    base::WeakPtr<WidgetBase> weak_this = weak_ptr_factory_.GetWeakPtr();
     GetCompositionRange(&range);
+    if (!weak_this) {
+      return;
+    }
     GetCompositionCharacterBounds(&character_bounds);
+    if (!weak_this) {
+      return;
+    }
   }

   if (!immediate_request &&