[webview_flutter_lwe] Fix use-after-free of disposed WebView in async callbacks

seungsoo47 · seungsoo47 · commit 65dbd9ad8cdf · 2026-07-07T17:27:14.000+09:00
The navigation-delegate callbacks (onPageStarted/onUrlChange, onPageFinished,
onProgress, onWebResourceError, navigationRequest) and the JavaScript-channel
callback are dispatched to the main loop asynchronously, and the
navigationRequest result is resolved asynchronously by the Dart side. Any of
them could run after the WebView was disposed and dereference the destroyed
WebView (and its now-freed method channels), causing a use-after-free.

Add a shared is_alive_ flag that Dispose() clears; every deferred callback
captures a copy and bails out when the WebView is gone, and
NavigationRequestResult checks it before touching the WebView.
diff --git a/packages/webview_flutter_lwe/CHANGELOG.md b/packages/webview_flutter_lwe/CHANGELOG.md
@@ -5,6 +5,8 @@
   is replaced after the WebView is created.
 * Fix a crash on the raster thread when a WebView is disposed while a frame is
   still being composited.
+* Fix a use-after-free when navigation-delegate or JavaScript-channel callbacks
+  run after the WebView has been disposed.
 * Add 1 integration test case.
 
 ## 0.4.1
diff --git a/packages/webview_flutter_lwe/tizen/src/webview.cc b/packages/webview_flutter_lwe/tizen/src/webview.cc
@@ -37,8 +37,15 @@ extern "C" size_t LWE_EXPORT createWebViewInstance(
 
 class NavigationRequestResult : public FlMethodResult {
  public:
-  NavigationRequestResult(std::string url, WebView* webview)
-      : url_(url), webview_(webview) {}
+  // |alive| is the WebView's is_alive_ flag. Dart resolves the
+  // "navigationRequest" method call asynchronously (it round-trips through
+  // the Dart navigation delegate), so this result's completion can run well
+  // after the WebView that created it has been disposed; |webview_| would
+  // then be a dangling pointer. Checking |alive| before dereferencing it
+  // avoids a use-after-free in that case.
+  NavigationRequestResult(std::string url, WebView* webview,
+                          std::shared_ptr<bool> alive)
+      : url_(url), webview_(webview), alive_(std::move(alive)) {}
 
   void SuccessInternal(const flutter::EncodableValue* should_load) override {
     if (std::holds_alternative<bool>(*should_load)) {
@@ -60,13 +67,17 @@ class NavigationRequestResult : public FlMethodResult {
 
  private:
   void LoadUrl() {
+    if (!*alive_) {
+      return;
+    }
     if (webview_ && webview_->GetWebViewInstance()) {
       webview_->GetWebViewInstance()->LoadURL(url_);
     }
   }
 
   std::string url_;
   WebView* webview_;
+  std::shared_ptr<bool> alive_;
 };
 
 template <typename T>
@@ -153,35 +164,45 @@ WebView::WebView(flutter::PluginRegistrar* registrar, int view_id,
         flutter::EncodableMap args = {
             {flutter::EncodableValue("url"), flutter::EncodableValue(url)}};
 
-        dispatcher_->dispatchTaskOnMainThread([this, args]() {
-          navigation_delegate_channel_->InvokeMethod(
-              "onPageStarted", std::make_unique<flutter::EncodableValue>(args));
-          // The lightweight web engine has no dedicated URL-change callback, so
-          // report a URL change whenever a navigation starts.
-          navigation_delegate_channel_->InvokeMethod(
-              "onUrlChange", std::make_unique<flutter::EncodableValue>(args));
-        });
+        dispatcher_->dispatchTaskOnMainThread(
+            [this, args, alive = is_alive_]() {
+              if (!*alive) return;
+              navigation_delegate_channel_->InvokeMethod(
+                  "onPageStarted",
+                  std::make_unique<flutter::EncodableValue>(args));
+              // The lightweight web engine has no dedicated URL-change
+              // callback, so report a URL change whenever a navigation
+              // starts.
+              navigation_delegate_channel_->InvokeMethod(
+                  "onUrlChange",
+                  std::make_unique<flutter::EncodableValue>(args));
+            });
       });
   webview_instance_->RegisterOnPageLoadedHandler(
       [this](LWE::WebContainer* container, const std::string& url) {
         flutter::EncodableMap args = {
             {flutter::EncodableValue("url"), flutter::EncodableValue(url)}};
 
-        dispatcher_->dispatchTaskOnMainThread([this, args]() {
-          navigation_delegate_channel_->InvokeMethod(
-              "onPageFinished",
-              std::make_unique<flutter::EncodableValue>(args));
-        });
+        dispatcher_->dispatchTaskOnMainThread(
+            [this, args, alive = is_alive_]() {
+              if (!*alive) return;
+              navigation_delegate_channel_->InvokeMethod(
+                  "onPageFinished",
+                  std::make_unique<flutter::EncodableValue>(args));
+            });
       });
   webview_instance_->RegisterOnProgressChangedHandler(
       [this](LWE::WebContainer* container, int progress) {
         flutter::EncodableMap args = {{flutter::EncodableValue("progress"),
                                        flutter::EncodableValue(progress)}};
 
-        dispatcher_->dispatchTaskOnMainThread([this, args]() {
-          navigation_delegate_channel_->InvokeMethod(
-              "onProgress", std::make_unique<flutter::EncodableValue>(args));
-        });
+        dispatcher_->dispatchTaskOnMainThread(
+            [this, args, alive = is_alive_]() {
+              if (!*alive) return;
+              navigation_delegate_channel_->InvokeMethod(
+                  "onProgress",
+                  std::make_unique<flutter::EncodableValue>(args));
+            });
       });
   webview_instance_->RegisterOnReceivedErrorHandler(
       [this](LWE::WebContainer* container, LWE::ResourceError error) {
@@ -193,11 +214,13 @@ WebView::WebView(flutter::PluginRegistrar* registrar, int view_id,
             {flutter::EncodableValue("failingUrl"),
              flutter::EncodableValue(error.GetUrl())},
         };
-        dispatcher_->dispatchTaskOnMainThread([this, args]() {
-          navigation_delegate_channel_->InvokeMethod(
-              "onWebResourceError",
-              std::make_unique<flutter::EncodableValue>(args));
-        });
+        dispatcher_->dispatchTaskOnMainThread(
+            [this, args, alive = is_alive_]() {
+              if (!*alive) return;
+              navigation_delegate_channel_->InvokeMethod(
+                  "onWebResourceError",
+                  std::make_unique<flutter::EncodableValue>(args));
+            });
       });
   webview_instance_->RegisterShouldOverrideUrlLoadingHandler(
       [this](LWE::WebContainer* view, const std::string& url) -> bool {
@@ -210,13 +233,16 @@ WebView::WebView(flutter::PluginRegistrar* registrar, int view_id,
              flutter::EncodableValue(true)},
         };
 
-        dispatcher_->dispatchTaskOnMainThread([this, args, url]() {
-          auto result = std::make_unique<NavigationRequestResult>(url, this);
-          navigation_delegate_channel_->InvokeMethod(
-              "navigationRequest",
-              std::make_unique<flutter::EncodableValue>(args),
-              std::move(result));
-        });
+        dispatcher_->dispatchTaskOnMainThread(
+            [this, args, url, alive = is_alive_]() {
+              if (!*alive) return;
+              auto result = std::make_unique<NavigationRequestResult>(
+                  url, this, alive);
+              navigation_delegate_channel_->InvokeMethod(
+                  "navigationRequest",
+                  std::make_unique<flutter::EncodableValue>(args),
+                  std::move(result));
+            });
         return true;
       });
 }
@@ -235,11 +261,13 @@ void WebView::RegisterJavaScriptChannelName(const std::string& name) {
         {flutter::EncodableValue("message"), flutter::EncodableValue(message)},
     };
 
-    dispatcher_->dispatchTaskOnMainThread([this, args]() {
-      webview_channel_->InvokeMethod(
-          "javaScriptChannelMessage",
-          std::make_unique<flutter::EncodableValue>(args));
-    });
+    dispatcher_->dispatchTaskOnMainThread(
+        [this, args, alive = is_alive_]() {
+          if (!*alive) return;
+          webview_channel_->InvokeMethod(
+              "javaScriptChannelMessage",
+              std::make_unique<flutter::EncodableValue>(args));
+        });
     return "success";
   };
   webview_instance_->AddJavaScriptInterface(name, "postMessage", on_message);
@@ -261,6 +289,12 @@ std::string WebView::GetNavigationDelegateChannelName() {
 }
 
 void WebView::Dispose() {
+  // Flip this before anything else: any dispatcher_ callback already queued
+  // on the main loop (e.g. a navigation event that fired just before this
+  // WebView was disposed) checks it and bails out instead of touching a
+  // WebView that may be fully destroyed by the time it runs.
+  *is_alive_ = false;
+
   // Stop the web engine first so its renderer thread stops writing into the
   // shared TBM surfaces before anything is torn down.
   if (webview_instance_) {
diff --git a/packages/webview_flutter_lwe/tizen/src/webview.h b/packages/webview_flutter_lwe/tizen/src/webview.h
@@ -81,6 +81,11 @@ class WebView : public PlatformView {
   bool is_mouse_lbutton_down_ = false;
   bool has_navigation_delegate_ = false;
   bool is_disposing_ = false;
+  // Set to false at the start of Dispose(). Every dispatcher_ callback that
+  // captures `this` also captures a copy of this shared_ptr, so a callback
+  // still queued on the main-loop when the WebView is disposed can check it
+  // and bail out instead of dereferencing an already-destroyed WebView.
+  std::shared_ptr<bool> is_alive_ = std::make_shared<bool>(true);
   // Shared (not unique) so a pending dispose callback can keep the
   // dispatcher alive by holding its own reference after the WebView that
   // created it has been destroyed.
