From 2a0bc6a6e04eb5edc6da5a8296e209678b41c96a Mon Sep 17 00:00:00 2001
From: Andreas Kling <andreas@ladybird.org>
Date: Sat, 13 Jun 2026 20:17:02 +0200
Subject: [PATCH] AK: Avoid clearing pointer wrappers during destruction

Delete or unref directly from RefPtr, NonnullRefPtr, and NonnullOwnPtr
destructors instead of calling clear() or exchanging the member pointer.
This avoids storing null when the wrapper lifetime is ending.
---
 AK/NonnullOwnPtr.h | 2 +-
 AK/NonnullRefPtr.h | 3 +--
 AK/RefPtr.h        | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/AK/NonnullOwnPtr.h b/AK/NonnullOwnPtr.h
index 10958af04f..4387ac3bff 100644
--- a/AK/NonnullOwnPtr.h
+++ b/AK/NonnullOwnPtr.h
@@ -47,7 +47,7 @@ public:
     }
     ~NonnullOwnPtr()
     {
-        clear();
+        delete m_ptr;
 #ifdef SANITIZE_PTRS
         m_ptr = (T*)(explode_byte(NONNULLOWNPTR_SCRUB_BYTE));
 #endif
diff --git a/AK/NonnullRefPtr.h b/AK/NonnullRefPtr.h
index a441bfc899..3e1b99e72b 100644
--- a/AK/NonnullRefPtr.h
+++ b/AK/NonnullRefPtr.h
@@ -93,8 +93,7 @@ public:
 
     ALWAYS_INLINE ~NonnullRefPtr()
     {
-        auto* ptr = exchange(m_ptr, nullptr);
-        unref_if_not_null(ptr);
+        unref_if_not_null(m_ptr);
 #ifdef SANITIZE_PTRS
         m_ptr = reinterpret_cast<T*>(explode_byte(NONNULLREFPTR_SCRUB_BYTE));
 #endif
diff --git a/AK/RefPtr.h b/AK/RefPtr.h
index 9083b4708b..c267e3b538 100644
--- a/AK/RefPtr.h
+++ b/AK/RefPtr.h
@@ -100,7 +100,7 @@ public:
 
     ALWAYS_INLINE ~RefPtr()
     {
-        clear();
+        unref_if_not_null(m_ptr);
 #ifdef SANITIZE_PTRS
         m_ptr = reinterpret_cast<T*>(explode_byte(REFPTR_SCRUB_BYTE));
 #endif