From 8e8909f79833d1f1ec59c3cde98ce29e5f97e201 Mon Sep 17 00:00:00 2001
From: Robert Flack <flackr@chromium.org>
Date: Tue, 01 Sep 2026 13:50:37 -0700
Subject: [PATCH] Harden GestureEventQueue, MouseWheelEventQueue, and TouchpadPinchEventQueue

Follow up to crrev.com/c/7776327 and crrev.com/c/7919026. This change
hardens the remaining input queues embedded in InputRouterImpl against
synchronous destruction during ACK processing if an ACK callback
triggers synchronous UI actions (e.g. overscroll navigation, popup
dismissals, or context menu loops) that destroy the owning
RenderWidgetHostImpl / InputRouterImpl.

Bug: 554953456, 552283275
Change-Id: I9b65eeeb1f9478275ae29bb52afc41de8c6011ed
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8328368
Commit-Queue: Robert Flack <flackr@chromium.org>
Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1690090}
---
diff --git a/components/input/gesture_event_queue.cc b/components/input/gesture_event_queue.cc
index 9444a4d..098fa35 100644
--- a/components/input/gesture_event_queue.cc
+++ b/components/input/gesture_event_queue.cc
@@ -6,6 +6,7 @@
 
 #include "base/auto_reset.h"
 #include "base/logging.h"
+#include "base/memory/weak_auto_reset.h"
 #include "base/trace_event/trace_event.h"
 #include "components/input/touchpad_tap_suppression_controller.h"
 #include "components/input/touchscreen_tap_suppression_controller.h"
@@ -223,7 +224,10 @@
   if (processing_acks_) {
     return;
   }
-  base::AutoReset<bool> process_acks(&processing_acks_, true);
+  base::WeakAutoReset reset_processing_acks(
+      weak_ptr_factory_.GetWeakPtr(), &GestureEventQueue::processing_acks_,
+      true);
+  auto weak_this = weak_ptr_factory_.GetWeakPtr();
   while (!sent_events_awaiting_ack_.empty()) {
     auto iter = sent_events_awaiting_ack_.begin();
     if (iter->ack_state() == blink::mojom::InputEventResultState::kUnknown) {
@@ -233,6 +237,9 @@
     sent_events_awaiting_ack_.erase(iter);
 
     AckGestureEventToClient(event, event.ack_source(), event.ack_state());
+    if (!weak_this) {
+      return;
+    }
   }
 }
 
diff --git a/components/input/gesture_event_queue.h b/components/input/gesture_event_queue.h
index 7a610d0..db528c9 100644
--- a/components/input/gesture_event_queue.h
+++ b/components/input/gesture_event_queue.h
@@ -10,6 +10,7 @@
 #include "base/component_export.h"
 #include "base/containers/circular_deque.h"
 #include "base/memory/raw_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "base/time/time.h"
 #include "base/timer/timer.h"
 #include "components/input/dispatch_to_renderer_callback.h"
@@ -246,6 +247,8 @@
   // True when the last GSE event is either in the debouncing_deferral_queue_ or
   // pushed to the queue and dropped from it later on.
   bool scroll_end_filtered_by_deboucing_deferral_queue_ = false;
+
+  base::WeakPtrFactory<GestureEventQueue> weak_ptr_factory_{this};
 };
 
 }  // namespace input
diff --git a/components/input/input_router_impl.cc b/components/input/input_router_impl.cc
index 2d3de8fb..51baeda2 100644
--- a/components/input/input_router_impl.cc
+++ b/components/input/input_router_impl.cc
@@ -553,7 +553,11 @@
     const GestureEventWithLatencyInfo& event,
     blink::mojom::InputEventResultSource ack_source,
     blink::mojom::InputEventResultState ack_result) {
+  auto weak_this = weak_ptr_factory_.GetWeakPtr();
   touch_event_queue_.OnGestureEventAck(event, ack_result);
+  if (!weak_this) {
+    return;
+  }
   disposition_handler_->OnGestureEventAck(event, ack_source, ack_result);
 }
 
@@ -588,7 +592,11 @@
     const MouseWheelEventWithLatencyInfo& event,
     blink::mojom::InputEventResultSource ack_source,
     blink::mojom::InputEventResultState ack_result) {
+  auto weak_this = weak_ptr_factory_.GetWeakPtr();
   disposition_handler_->OnWheelEventAck(event, ack_source, ack_result);
+  if (!weak_this) {
+    return;
+  }
   gesture_event_queue_.OnWheelEventAck(event, ack_source, ack_result);
 }
 
diff --git a/components/input/mouse_wheel_event_queue.cc b/components/input/mouse_wheel_event_queue.cc
index f5468fd..8a8dea1 100644
--- a/components/input/mouse_wheel_event_queue.cc
+++ b/components/input/mouse_wheel_event_queue.cc
@@ -132,8 +132,12 @@
     return;
 
   event_sent_for_gesture_ack_->latency.AddNewLatencyFrom(ack_event.latency);
+  auto weak_this = weak_ptr_factory_.GetWeakPtr();
   client_->OnMouseWheelEventAck(*event_sent_for_gesture_ack_, ack_source,
                                 ack_result);
+  if (!weak_this) {
+    return;
+  }
 
   // If event wasn't consumed then generate a gesture scroll for it.
   if (CanGenerateGestureScroll(ack_result)) {
@@ -311,7 +315,7 @@
   client_->SendMouseWheelEventImmediately(
       *event_sent_for_gesture_ack_,
       base::BindOnce(&MouseWheelEventQueue::ProcessMouseWheelAck,
-                     base::Unretained(this)),
+                     weak_ptr_factory_.GetWeakPtr()),
       event_sent_for_gesture_ack_->dispatch_callback);
 }
 
diff --git a/components/input/mouse_wheel_event_queue.h b/components/input/mouse_wheel_event_queue.h
index d7c13d1..e6d136d9 100644
--- a/components/input/mouse_wheel_event_queue.h
+++ b/components/input/mouse_wheel_event_queue.h
@@ -11,6 +11,7 @@
 #include "base/containers/circular_deque.h"
 #include "base/functional/callback.h"
 #include "base/memory/raw_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "components/input/dispatch_to_renderer_callback.h"
 #include "components/input/event_with_latency_info.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
@@ -121,6 +122,8 @@
   bool send_wheel_events_async_;
 
   blink::WebGestureDevice scrolling_device_;
+
+  base::WeakPtrFactory<MouseWheelEventQueue> weak_ptr_factory_{this};
 };
 
 }  // namespace input
diff --git a/components/input/touchpad_pinch_event_queue.cc b/components/input/touchpad_pinch_event_queue.cc
index af8e12f..c5f2c17 100644
--- a/components/input/touchpad_pinch_event_queue.cc
+++ b/components/input/touchpad_pinch_event_queue.cc
@@ -148,8 +148,12 @@
         (ack_result == blink::mojom::InputEventResultState::kConsumed);
 
   pinch_event_awaiting_ack_->latency.AddNewLatencyFrom(ack_event.latency);
+  auto weak_this = weak_ptr_factory_.GetWeakPtr();
   client_->OnGestureEventForPinchAck(*pinch_event_awaiting_ack_, ack_source,
                                      ack_result);
+  if (!weak_this) {
+    return;
+  }
 
   pinch_event_awaiting_ack_.reset();
   TryForwardNextEventToRenderer();
@@ -167,13 +171,22 @@
 
   if (pinch_event_awaiting_ack_->event.GetType() ==
       blink::WebInputEvent::Type::kGesturePinchBegin) {
+    auto weak_this = weak_ptr_factory_.GetWeakPtr();
+    auto dispatch_callback =
+        std::move(pinch_event_awaiting_ack_->dispatch_callback);
+    const blink::WebGestureEvent event = pinch_event_awaiting_ack_->event;
     client_->OnGestureEventForPinchAck(
         *pinch_event_awaiting_ack_,
         blink::mojom::InputEventResultSource::kBrowser,
         blink::mojom::InputEventResultState::kIgnored);
-    std::move(pinch_event_awaiting_ack_->dispatch_callback)
-        .Run(pinch_event_awaiting_ack_->event,
-             DispatchToRendererResult::kNotDispatched);
+    if (!weak_this) {
+      return;
+    }
+    std::move(dispatch_callback)
+        .Run(event, DispatchToRendererResult::kNotDispatched);
+    if (!weak_this) {
+      return;
+    }
     pinch_event_awaiting_ack_.reset();
     TryForwardNextEventToRenderer();
     return;
@@ -215,7 +228,7 @@
   client_->SendMouseWheelEventForPinchImmediately(
       pinch_event_awaiting_ack_->event, synthetic_wheel,
       base::BindOnce(&TouchpadPinchEventQueue::ProcessMouseWheelAck,
-                     base::Unretained(this)),
+                     weak_ptr_factory_.GetWeakPtr()),
       pinch_event_awaiting_ack_->dispatch_callback);
 }
 
diff --git a/components/input/touchpad_pinch_event_queue.h b/components/input/touchpad_pinch_event_queue.h
index b6a559b..d3c32cd3 100644
--- a/components/input/touchpad_pinch_event_queue.h
+++ b/components/input/touchpad_pinch_event_queue.h
@@ -11,6 +11,7 @@
 #include "base/component_export.h"
 #include "base/containers/circular_deque.h"
 #include "base/memory/raw_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "components/input/dispatch_to_renderer_callback.h"
 #include "components/input/event_with_latency_info.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
@@ -80,6 +81,8 @@
   base::circular_deque<std::unique_ptr<QueuedTouchpadPinchEvent>> pinch_queue_;
   std::unique_ptr<QueuedTouchpadPinchEvent> pinch_event_awaiting_ack_;
   std::optional<bool> first_event_prevented_;
+
+  base::WeakPtrFactory<TouchpadPinchEventQueue> weak_ptr_factory_{this};
 };
 
 }  // namespace input
diff --git a/content/browser/renderer_host/input/mock_input_disposition_handler.cc b/content/browser/renderer_host/input/mock_input_disposition_handler.cc
index 56c2588..9dd1908 100644
--- a/content/browser/renderer_host/input/mock_input_disposition_handler.cc
+++ b/content/browser/renderer_host/input/mock_input_disposition_handler.cc
@@ -40,6 +40,9 @@
   acked_wheel_event_ = event.event;
   acked_wheel_event_state_ = ack_result;
   RecordAckCalled(event.event.GetType(), ack_result);
+  if (on_wheel_event_ack_closure_) {
+    std::move(on_wheel_event_ack_closure_).Run();
+  }
 }
 
 void MockInputDispositionHandler::OnTouchEventAck(
@@ -73,6 +76,9 @@
   VLOG(1) << __FUNCTION__ << " called!";
   acked_gesture_event_ = event.event;
   RecordAckCalled(event.event.GetType(), ack_result);
+  if (on_gesture_event_ack_closure_) {
+    std::move(on_gesture_event_ack_closure_).Run();
+  }
 }
 
 size_t MockInputDispositionHandler::GetAndResetAckCount() {
diff --git a/content/browser/renderer_host/input/mock_input_disposition_handler.h b/content/browser/renderer_host/input/mock_input_disposition_handler.h
index c2e5528..5c3d709 100644
--- a/content/browser/renderer_host/input/mock_input_disposition_handler.h
+++ b/content/browser/renderer_host/input/mock_input_disposition_handler.h
@@ -57,6 +57,14 @@
     on_touch_event_ack_closure_ = std::move(closure);
   }
 
+  void set_on_gesture_event_ack_closure(base::OnceClosure closure) {
+    on_gesture_event_ack_closure_ = std::move(closure);
+  }
+
+  void set_on_wheel_event_ack_closure(base::OnceClosure closure) {
+    on_wheel_event_ack_closure_ = std::move(closure);
+  }
+
   blink::mojom::InputEventResultState ack_state() const { return ack_state_; }
 
   blink::mojom::InputEventResultState acked_wheel_event_state() const {
@@ -105,6 +113,8 @@
   std::unique_ptr<input::GestureEventWithLatencyInfo> gesture_followup_event_;
   std::unique_ptr<input::TouchEventWithLatencyInfo> touch_followup_event_;
   base::OnceClosure on_touch_event_ack_closure_;
+  base::OnceClosure on_gesture_event_ack_closure_;
+  base::OnceClosure on_wheel_event_ack_closure_;
 };
 
 }  // namespace content
diff --git a/components/input/gesture_event_queue_unittest.cc b/components/input/gesture_event_queue_unittest.cc
index 72b7f345..8ff53f8 100644
--- a/components/input/gesture_event_queue_unittest.cc
+++ b/components/input/gesture_event_queue_unittest.cc
@@ -88,6 +88,10 @@
       blink::mojom::InputEventResultState ack_result) override {
     ++acked_gesture_event_count_;
     last_acked_event_ = event.event;
+    if (destroy_queue_on_ack_) {
+      queue_.reset();
+      return;
+    }
     if (sync_followup_event_) {
       auto sync_followup_event = std::move(sync_followup_event_);
       SimulateGestureEvent(*sync_followup_event);
@@ -242,6 +246,10 @@
 
   GestureEventQueue* queue() const { return queue_.get(); }
 
+  void set_destroy_queue_on_ack(bool destroy) {
+    destroy_queue_on_ack_ = destroy;
+  }
+
  private:
   base::test::SingleThreadTaskEnvironment task_environment_;
   std::unique_ptr<GestureEventQueue> queue_;
@@ -250,6 +258,7 @@
   WebGestureEvent last_acked_event_;
   std::unique_ptr<blink::mojom::InputEventResultState> sync_ack_result_;
   std::unique_ptr<WebGestureEvent> sync_followup_event_;
+  bool destroy_queue_on_ack_ = false;
   base::test::ScopedFeatureList feature_list_;
 };
 
@@ -644,4 +653,16 @@
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
 }
 
+TEST_F(GestureEventQueueTest, SynchronousDestructionDuringAck) {
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
+                       blink::WebGestureDevice::kTouchscreen);
+  EXPECT_EQ(1U, GestureEventQueueSize());
+
+  set_destroy_queue_on_ack(true);
+  SendInputEventACK(WebInputEvent::Type::kGestureTapDown,
+                    blink::mojom::InputEventResultState::kConsumed);
+
+  EXPECT_EQ(nullptr, queue());
+}
+
 }  // namespace input
diff --git a/components/input/mouse_wheel_event_queue_unittest.cc b/components/input/mouse_wheel_event_queue_unittest.cc
index 901e4a0e..ed28ebb 100644
--- a/components/input/mouse_wheel_event_queue_unittest.cc
+++ b/components/input/mouse_wheel_event_queue_unittest.cc
@@ -198,6 +198,10 @@
     ++acked_event_count_;
     last_acked_event_ = event.event;
     last_acked_event_state_ = ack_result;
+    if (destroy_queue_on_ack_) {
+      queue_.reset();
+      return;
+    }
   }
 
   bool IsWheelScrollInProgress() override {
@@ -402,6 +406,10 @@
     EXPECT_EQ(1U, GetAndResetSentEventCount());
   }
 
+  void set_destroy_queue_on_ack(bool destroy) {
+    destroy_queue_on_ack_ = destroy;
+  }
+
   base::test::SingleThreadTaskEnvironment task_environment_;
   std::unique_ptr<MouseWheelEventQueue> queue_;
   std::vector<std::unique_ptr<WebInputEvent>> sent_events_;
@@ -409,6 +417,7 @@
   size_t acked_event_count_;
   blink::mojom::InputEventResultState last_acked_event_state_;
   WebMouseWheelEvent last_acked_event_;
+  bool destroy_queue_on_ack_ = false;
 
  private:
   bool is_wheel_scroll_in_progress_ = false;
@@ -709,4 +718,18 @@
   EXPECT_EQ(2U, GetAndResetSentEventCount());
 }
 #endif
+TEST_F(MouseWheelEventQueueTest, SynchronousDestructionDuringAck) {
+  SendMouseWheel(kWheelScrollX, kWheelScrollY, kWheelScrollGlobalX,
+                 kWheelScrollGlobalY, 1, 1, 0, false,
+                 WebMouseWheelEvent::kPhaseBegan,
+                 WebMouseWheelEvent::kPhaseNone);
+  EXPECT_EQ(0U, queued_event_count());
+  EXPECT_TRUE(event_in_flight());
+
+  set_destroy_queue_on_ack(true);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
+
+  EXPECT_EQ(nullptr, queue_);
+}
+
 }  // namespace input
diff --git a/components/input/touchpad_pinch_event_queue_unittest.cc b/components/input/touchpad_pinch_event_queue_unittest.cc
index 49e5d9e..3ce1231 100644
--- a/components/input/touchpad_pinch_event_queue_unittest.cc
+++ b/components/input/touchpad_pinch_event_queue_unittest.cc
@@ -127,11 +127,19 @@
       blink::mojom::InputEventResultSource ack_source,
       blink::mojom::InputEventResultState ack_result) override {
     mock_client_.OnGestureEventForPinchAck(event, ack_source, ack_result);
+    if (destroy_queue_on_ack_) {
+      queue_.reset();
+    }
+  }
+
+  void set_destroy_queue_on_ack(bool destroy) {
+    destroy_queue_on_ack_ = destroy;
   }
 
   testing::StrictMock<MockTouchpadPinchEventQueueClient> mock_client_;
   std::unique_ptr<TouchpadPinchEventQueue> queue_;
   base::circular_deque<HandleEventCallback> callbacks_;
+  bool destroy_queue_on_ack_ = false;
 };
... (file diff truncated)

diff --git a/components/input/gesture_event_queue_unittest.cc b/components/input/gesture_event_queue_unittest.cc
index 72b7f345..8ff53f8 100644
--- a/components/input/gesture_event_queue_unittest.cc
+++ b/components/input/gesture_event_queue_unittest.cc
@@ -88,6 +88,10 @@
       blink::mojom::InputEventResultState ack_result) override {
     ++acked_gesture_event_count_;
     last_acked_event_ = event.event;
+    if (destroy_queue_on_ack_) {
+      queue_.reset();
+      return;
+    }
     if (sync_followup_event_) {
       auto sync_followup_event = std::move(sync_followup_event_);
       SimulateGestureEvent(*sync_followup_event);
@@ -242,6 +246,10 @@
 
   GestureEventQueue* queue() const { return queue_.get(); }
 
+  void set_destroy_queue_on_ack(bool destroy) {
+    destroy_queue_on_ack_ = destroy;
+  }
+
  private:
   base::test::SingleThreadTaskEnvironment task_environment_;
   std::unique_ptr<GestureEventQueue> queue_;
@@ -250,6 +258,7 @@
   WebGestureEvent last_acked_event_;
   std::unique_ptr<blink::mojom::InputEventResultState> sync_ack_result_;
   std::unique_ptr<WebGestureEvent> sync_followup_event_;
+  bool destroy_queue_on_ack_ = false;
   base::test::ScopedFeatureList feature_list_;
 };
 
@@ -644,4 +653,16 @@
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
 }
 
+TEST_F(GestureEventQueueTest, SynchronousDestructionDuringAck) {
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
+                       blink::WebGestureDevice::kTouchscreen);
+  EXPECT_EQ(1U, GestureEventQueueSize());
+
+  set_destroy_queue_on_ack(true);
+  SendInputEventACK(WebInputEvent::Type::kGestureTapDown,
+                    blink::mojom::InputEventResultState::kConsumed);
+
+  EXPECT_EQ(nullptr, queue());
+}
+
 }  // namespace input
diff --git a/components/input/mouse_wheel_event_queue_unittest.cc b/components/input/mouse_wheel_event_queue_unittest.cc
index 901e4a0e..ed28ebb 100644
--- a/components/input/mouse_wheel_event_queue_unittest.cc
+++ b/components/input/mouse_wheel_event_queue_unittest.cc
@@ -198,6 +198,10 @@
     ++acked_event_count_;
     last_acked_event_ = event.event;
     last_acked_event_state_ = ack_result;
+    if (destroy_queue_on_ack_) {
+      queue_.reset();
+      return;
+    }
   }
 
   bool IsWheelScrollInProgress() override {
@@ -402,6 +406,10 @@
     EXPECT_EQ(1U, GetAndResetSentEventCount());
   }
 
+  void set_destroy_queue_on_ack(bool destroy) {
+    destroy_queue_on_ack_ = destroy;
+  }
+
   base::test::SingleThreadTaskEnvironment task_environment_;
   std::unique_ptr<MouseWheelEventQueue> queue_;
   std::vector<std::unique_ptr<WebInputEvent>> sent_events_;
@@ -409,6 +417,7 @@
   size_t acked_event_count_;
   blink::mojom::InputEventResultState last_acked_event_state_;
   WebMouseWheelEvent last_acked_event_;
+  bool destroy_queue_on_ack_ = false;
 
  private:
   bool is_wheel_scroll_in_progress_ = false;
@@ -709,4 +718,18 @@
   EXPECT_EQ(2U, GetAndResetSentEventCount());
 }
 #endif
+TEST_F(MouseWheelEventQueueTest, SynchronousDestructionDuringAck) {
+  SendMouseWheel(kWheelScrollX, kWheelScrollY, kWheelScrollGlobalX,
+                 kWheelScrollGlobalY, 1, 1, 0, false,
+                 WebMouseWheelEvent::kPhaseBegan,
+                 WebMouseWheelEvent::kPhaseNone);
+  EXPECT_EQ(0U, queued_event_count());
+  EXPECT_TRUE(event_in_flight());
+
+  set_destroy_queue_on_ack(true);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
+
+  EXPECT_EQ(nullptr, queue_);
+}
+
 }  // namespace input
diff --git a/components/input/touchpad_pinch_event_queue_unittest.cc b/components/input/touchpad_pinch_event_queue_unittest.cc
index 49e5d9e..3ce1231 100644
--- a/components/input/touchpad_pinch_event_queue_unittest.cc
+++ b/components/input/touchpad_pinch_event_queue_unittest.cc
@@ -127,11 +127,19 @@
       blink::mojom::InputEventResultSource ack_source,
       blink::mojom::InputEventResultState ack_result) override {
     mock_client_.OnGestureEventForPinchAck(event, ack_source, ack_result);
+    if (destroy_queue_on_ack_) {
+      queue_.reset();
+    }
+  }
+
+  void set_destroy_queue_on_ack(bool destroy) {
+    destroy_queue_on_ack_ = destroy;
   }
 
   testing::StrictMock<MockTouchpadPinchEventQueueClient> mock_client_;
   std::unique_ptr<TouchpadPinchEventQueue> queue_;
   base::circular_deque<HandleEventCallback> callbacks_;
+  bool destroy_queue_on_ack_ = false;
 };
 
 MATCHER_P(EventHasType,
@@ -630,4 +638,42 @@
                     blink::mojom::InputEventResultState::kIgnored);
 }
 
+TEST_F(TouchpadPinchEventQueueTest, SynchronousDestructionDuringPinchBeginAck) {
+  set_destroy_queue_on_ack(true);
+  EXPECT_CALL(mock_client_,
+              OnGestureEventForPinchAck(
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
+  QueuePinchBegin();
+  EXPECT_EQ(nullptr, queue_);
+}
+
+TEST_F(TouchpadPinchEventQueueTest,
+       SynchronousDestructionDuringPinchUpdateAck) {
+  ::testing::InSequence sequence;
+  EXPECT_CALL(mock_client_,
+              OnGestureEventForPinchAck(
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
+  EXPECT_CALL(mock_client_,
+              SendMouseWheelEventForPinchImmediately(
+                  ::testing::AllOf(EventHasCtrlModifier(), EventIsBlocking())));
+  EXPECT_CALL(mock_client_,
+              OnGestureEventForPinchAck(
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+                  blink::mojom::InputEventResultSource::kMainThread,
+                  blink::mojom::InputEventResultState::kConsumed));
+
+  QueuePinchBegin();
+  QueuePinchUpdate(1.23, false);
+
+  set_destroy_queue_on_ack(true);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kMainThread,
+                    blink::mojom::InputEventResultState::kConsumed);
+
+  EXPECT_EQ(nullptr, queue_);
+}
+
 }  // namespace input
diff --git a/content/browser/renderer_host/input/input_router_impl_unittest.cc b/content/browser/renderer_host/input/input_router_impl_unittest.cc
index 72cff09..9dcc7ec 100644
--- a/content/browser/renderer_host/input/input_router_impl_unittest.cc
+++ b/content/browser/renderer_host/input/input_router_impl_unittest.cc
@@ -2957,4 +2957,46 @@
   EXPECT_EQ(nullptr, input_router_);
 }
 
+TEST_F(InputRouterImplTest, SynchronousDestructionDuringGestureAck) {
+  blink::WebGestureEvent gesture =
+      blink::SyntheticWebGestureEventBuilder::Build(
+          WebInputEvent::Type::kGestureTapDown,
+          blink::WebGestureDevice::kTouchscreen);
+
+  // Set the disposition handler to destroy the input router during ACK.
+  disposition_handler_->set_on_gesture_event_ack_closure(base::BindOnce(
+      [](std::unique_ptr<input::InputRouterImpl>* router) { router->reset(); },
+      &input_router_));
+
+  // Trigger an ACK.
+  input::GestureEventWithLatencyInfo gesture_event(gesture);
+  static_cast<input::GestureEventQueueClient*>(input_router_.get())
+      ->OnGestureEventAck(gesture_event,
+                          blink::mojom::InputEventResultSource::kMainThread,
+                          blink::mojom::InputEventResultState::kConsumed);
+
+  EXPECT_EQ(nullptr, input_router_);
+}
+
+TEST_F(InputRouterImplTest, SynchronousDestructionDuringWheelAck) {
+  blink::WebMouseWheelEvent wheel =
+      blink::SyntheticWebMouseWheelEventBuilder::Build(
+          10, 10, 50, 50, 1, 1, 0,
+          ui::ScrollGranularity::kScrollByPrecisePixel);
+
+  // Set the disposition handler to destroy the input router during ACK.
+  disposition_handler_->set_on_wheel_event_ack_closure(base::BindOnce(
+      [](std::unique_ptr<input::InputRouterImpl>* router) { router->reset(); },
+      &input_router_));
+
+  // Trigger an ACK.
+  input::MouseWheelEventWithLatencyInfo wheel_event(wheel);
+  static_cast<input::MouseWheelEventQueueClient*>(input_router_.get())
+      ->OnMouseWheelEventAck(wheel_event,
+                             blink::mojom::InputEventResultSource::kMainThread,
+                             blink::mojom::InputEventResultState::kConsumed);
+
+  EXPECT_EQ(nullptr, input_router_);
+}
+
 }  // namespace content