From 3690d9f8f623b3bca8286cdc22dd6f7d134be35f Mon Sep 17 00:00:00 2001
From: Jason Simmons <jsimmons@google.com>
Date: Wed, 12 Aug 2020 17:59:34 -0700
Subject: [PATCH] Do not access members after calling ClearDartWrapper

ClearDartWrapper drops Dart's reference to the wrappable object,
which may cause the object to be deleted.

Fixes https://github.com/flutter/flutter/issues/63578
---
 lib/ui/painting/canvas.cc  | 2 +-
 lib/ui/painting/image.cc   | 2 +-
 lib/ui/painting/picture.cc | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/ui/painting/canvas.cc b/lib/ui/painting/canvas.cc
index 129226d36a4ce..01e6f5cf96a6f 100644
--- a/lib/ui/painting/canvas.cc
+++ b/lib/ui/painting/canvas.cc
@@ -486,10 +486,10 @@ void Canvas::drawShadow(const CanvasPath* path,
 }
 
 void Canvas::Invalidate() {
+  canvas_ = nullptr;
   if (dart_wrapper()) {
     ClearDartWrapper();
   }
-  canvas_ = nullptr;
 }
 
 }  // namespace flutter
diff --git a/lib/ui/painting/image.cc b/lib/ui/painting/image.cc
index 126205530fa4a..7da7c0ad029ec 100644
--- a/lib/ui/painting/image.cc
+++ b/lib/ui/painting/image.cc
@@ -37,8 +37,8 @@ Dart_Handle CanvasImage::toByteData(int format, Dart_Handle callback) {
 }
 
 void CanvasImage::dispose() {
-  ClearDartWrapper();
   image_.reset();
+  ClearDartWrapper();
 }
 
 size_t CanvasImage::GetAllocationSize() const {
diff --git a/lib/ui/painting/picture.cc b/lib/ui/painting/picture.cc
index 48dd11226cf26..1285a6b0921cb 100644
--- a/lib/ui/painting/picture.cc
+++ b/lib/ui/painting/picture.cc
@@ -56,8 +56,8 @@ Dart_Handle Picture::toImage(uint32_t width,
 }
 
 void Picture::dispose() {
-  ClearDartWrapper();
   picture_.reset();
+  ClearDartWrapper();
 }
 
 size_t Picture::GetAllocationSize() const {