diff --git a/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc b/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc index 53816cc50e833..b1afcb1a5941b 100644 --- a/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc +++ b/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc @@ -141,7 +141,13 @@ void BrowserDesktopWindowTreeHostLinux::TabDraggingKindChanged( browser_widget_->tab_drag_kind() == TabDragKind::kAllTabs; bool is_dragging_window = tab_drag_kind == TabDragKind::kAllTabs; if (is_dragging_window != was_dragging_window) { + auto weak_ptr = GetWeakPtr(); x11_extension->SetOverrideRedirect(is_dragging_window); + // SetOverrideRedirect() → Map() can synchronously dispatch a bounds + // change that destroys |this| (and the platform window). + if (!weak_ptr) { + return; + } } } diff --git a/ui/ozone/platform/x11/x11_window.cc b/ui/ozone/platform/x11/x11_window.cc index 57ffaee839fc4..26ff22dc7acbb 100644 --- a/ui/ozone/platform/x11/x11_window.cc +++ b/ui/ozone/platform/x11/x11_window.cc @@ -1333,7 +1333,13 @@ void X11Window::SetOverrideRedirect(bool override_redirect) { .override_redirect = x11::Bool32(override_redirect), }); if (remap) { + auto weak_this = weak_ptr_factory_.GetWeakPtr(); Map(); + // Map() → GetBoundsInPixels() → GeometryCache::GetBoundsPx() can re-enter + // OnBoundsChanged() and synchronously destroy |this| (crbug.com/1068755). + if (!weak_this) { + return; + } // We cannot regrab the pointer now since unmapping/mapping // happens asynchronously. We must wait until the window is // mapped to issue a grab request.