This fixes a use-after-free (observed as a crash / ASan hit) in HTMLDialogElement command handling by snapshotting the invoker’s value string before dispatching author-observable events. HTMLDialogElement::handleCommandInternal, for the Close and RequestClose commands, called close(invoker.value().string(), &invoker) / requestClose(invoker.value().string(), &invoker) — passing a string derived from the invoker button’s value attribute directly as an argument while also passing &invoker. close()/requestClose() dispatch events (e.g. beforetoggle/close) that run author script; that script can mutate or remove the invoker button’s value attribute during the call. Because the string was obtained from the invoker’s attribute storage as part of the call, author code mutating that attribute mid-close can invalidate the underlying string data the operation is still using, yielding a use-after-free of the attribute-backed string.

The fix hoists the value into an owned local first (String value = invoker.value().string();) and passes that local to close(value, &invoker) / requestClose(value, &invoker), so the value is captured before any event fires and cannot be invalidated by author script that alters the invoker during the close sequence.

The restored invariant is that the command value is a stable snapshot taken before author-observable side effects run. The regression test opens a dialog, and in a beforetoggle handler removes the button’s value attribute while the close command runs, expecting no crash and PASS returnValue.

A use-after-free in the WebContent process reachable from ordinary HTML/JS by mutating the invoker during a dialog close. Event-driven mutate-during-use UAFs are controllable with heap grooming; the advisory rates it a crash, and the class can escalate toward memory disclosure/corruption in WebContent.