Click anywhere

On click, this page enters HTML fullscreen and then calls window.print(). On Windows desktop Chrome, PrintViewManager::OnScriptedPrintPreviewCallback() calls web_contents()->ExitFullscreen(true) and continues to dereference this without a WeakPtr re-check. If the synchronous SetWindowLong/SetWindowPos dispatch processes a window-destruction message during the fullscreen exit, the WebContents (and its WebContentsUserData-owned PrintViewManager) is freed while OnScriptedPrintPreviewCallback is still on the stack, leading to a browser-process use-after-free with virtual-call dispatch on the freed object.