From 134176a1d1444ead2304ba5ab8b517415d0c8ac9 Mon Sep 17 00:00:00 2001 From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com> Date: Wed, 25 Sep 2024 13:17:59 +0200 Subject: [PATCH] fix: detach native view when its removed from parent on macOS (#43922) Right now DelayedNativeViewHost attaches its underlying native view when it's being attached to a widget but it doesn't detach it when it's being detached. It may lead to use-after-free and crash. Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com> Co-authored-by: Cezary Kulakowski --- shell/browser/ui/cocoa/delayed_native_view_host.mm | 2 ++ 1 file changed, 2 insertions(+) diff --git a/shell/browser/ui/cocoa/delayed_native_view_host.mm b/shell/browser/ui/cocoa/delayed_native_view_host.mm index 6d594e964717..78a5668a4dcc 100644 --- a/shell/browser/ui/cocoa/delayed_native_view_host.mm +++ b/shell/browser/ui/cocoa/delayed_native_view_host.mm @@ -15,6 +15,8 @@ DelayedNativeViewHost::~DelayedNativeViewHost() = default; void DelayedNativeViewHost::ViewHierarchyChanged( const views::ViewHierarchyChangedDetails& details) { + if (!details.is_add && native_view()) + Detach(); NativeViewHost::ViewHierarchyChanged(details); if (details.is_add && GetWidget() && !native_view()) Attach(native_view_);