diff --git a/third_party/blink/renderer/core/frame/local_frame_view.cc b/third_party/blink/renderer/core/frame/local_frame_view.cc index 082ad86152824..6eca27dc91fcb 100644 --- a/third_party/blink/renderer/core/frame/local_frame_view.cc +++ b/third_party/blink/renderer/core/frame/local_frame_view.cc @@ -2357,6 +2357,12 @@ bool LocalFrameView::UpdateLifecyclePhases( // Run the lifecycle updates. UpdateLifecyclePhasesInternal(target_state, reason); + // The local root may have been synchronously detached via a nested message + // loop spun from ResizeObserver script during the lifecycle update. + if (!GetFrame().GetPage()) { + return false; + } + if (target_state == DocumentLifecycle::kPaintClean) { TRACE_EVENT0("blink", "LocalFrameView::DidFinishLifecycleUpdate"); @@ -2447,6 +2453,12 @@ void LocalFrameView::UpdateLifecyclePhasesInternal( DocumentLifecycle::kVisualUpdatePending); } } + // RunResizeObserverSteps (below) runs script which can spin a nested + // message loop (e.g. via window.print()) and synchronously detach the + // local root frame. Bail out before touching frame state in that case. + if (!GetFrame().GetPage()) { + return; + } bool run_more_lifecycle_phases = RunStyleAndLayoutLifecyclePhases(target_state); if (!run_more_lifecycle_phases) { diff --git a/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc b/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc index 1395aa71a377c..e8831437f2acf 100644 --- a/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc +++ b/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc @@ -1777,6 +1777,11 @@ void WebFrameWidgetImpl::UpdateLifecycle(WebLifecycleUpdate requested_update, GetPage()->UpdateLifecycle(*LocalRootImpl()->GetFrame(), requested_update, reason); + // The local root may have been synchronously detached via a nested message + // loop spun from ResizeObserver script during the lifecycle update. + if (!LocalRootImpl()) { + return; + } if (requested_update != WebLifecycleUpdate::kAll) return; diff --git a/third_party/blink/renderer/platform/widget/widget_base.cc b/third_party/blink/renderer/platform/widget/widget_base.cc index 70a4733201db9..1312c188046ca 100644 --- a/third_party/blink/renderer/platform/widget/widget_base.cc +++ b/third_party/blink/renderer/platform/widget/widget_base.cc @@ -1145,7 +1145,13 @@ void WidgetBase::UpdateVisualState() { ShouldRecordBeginMainFrameMetrics() ? DocumentUpdateReason::kBeginMainFrame : DocumentUpdateReason::kTest; + auto weak_this = weak_ptr_factory_.GetWeakPtr(); client_->UpdateLifecycle(WebLifecycleUpdate::kAll, lifecycle_reason); + // UpdateLifecycle runs ResizeObserver script which can spin a nested message + // loop (e.g. via window.print()) and synchronously destroy this WidgetBase. + if (!weak_this) { + return; + } client_->SetSuppressFrameRequestsWorkaroundFor704763Only(false); }