Touch here. The pointerdown handler runs synchronously inside WidgetBaseInputHandler::HandleTouchEvent line 285. The injected destruction (simulating the Delete IPC during a nested event loop) fires after this handler returns; line 288 then UAFs.