From 3f6b0d2d4a2e7bb8193b1ddca84cb556d38288a2 Mon Sep 17 00:00:00 2001
From: Muki Kiboigo <muki@muki.gg>
Date: Tue, 8 Sep 2026 11:54:34 -0700
Subject: [PATCH] fix notification use-after-free

---
 src/server/cdp/CDP.zig | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/server/cdp/CDP.zig b/src/server/cdp/CDP.zig
index 4785f787a..152d08f2c 100644
--- a/src/server/cdp/CDP.zig
+++ b/src/server/cdp/CDP.zig
@@ -615,6 +615,18 @@ pub const BrowserContext = struct {
         self.node_registry.deinit();
         self.node_search_list.deinit();
         self.set_child_nodes_sent.deinit(self.cdp.allocator);
+
+        // CorsGate/RobotsGate fetches are ownerless, so closeSession's owner-based teardown never reaches them.
+        //
+        // They still carry this notification (copied for CDP correlation) and can outlive it, so clear
+        // the pointer here or Transfer.kill's later notify() dispatches through a freed Notification when
+        // the http_client itself is torn down.
+        var transfer_it = http_client.transfers.valueIterator();
+        while (transfer_it.next()) |t| {
+            if (t.*.req.notification == self.notification) {
+                t.*.req.notification = null;
+            }
+        }
         self.notification.deinit();
 
         if (self.http_proxy_changed) {