diff --git a/third_party/blink/renderer/platform/widget/input/widget_base_input_handler.cc b/third_party/blink/renderer/platform/widget/input/widget_base_input_handler.cc index 3ad3e9f40ec73..cfb5bd208d71b 100644 --- a/third_party/blink/renderer/platform/widget/input/widget_base_input_handler.cc +++ b/third_party/blink/renderer/platform/widget/input/widget_base_input_handler.cc @@ -407,6 +407,21 @@ void WidgetBaseInputHandler::HandleInputEvent( prevent_default = prevent_default || suppress; } + // WillHandleMouseEvent / WillHandleGestureEvent above can run script (e.g. + // cursor_control gestures call MoveCaretSelection which can synchronously + // dispatch focus/blur events) which may destroy this WidgetBase via a nested + // event loop. Bail out before touching any members. + if (!weak_self) { + if (callback) { + std::move(callback).Run( + prevent_default ? mojom::blink::InputEventResultState::kConsumed + : mojom::blink::InputEventResultState::kNotConsumed, + swap_latency_info, std::move(handling_state.event_overscroll()), + std::move(handling_state.touch_action())); + } + return; + } + WebInputEventResult processed = prevent_default ? WebInputEventResult::kHandledSuppressed : WebInputEventResult::kNotHandled;