From b21788e67d34569903e09a1fbd9d03d432de434b Mon Sep 17 00:00:00 2001
From: Alexandra Pereira <[email protected]>
Date: Thu, 10 Sep 2026 06:50:30 -0700
Subject: [PATCH] [iOS] Clear WebUI if navigation fails or leaves WebUI

This CL adds a check to ensure ClearWebUI() is called in
OnNavigationFinished() when the navigation does not commit or commits to
a non WebUI URL. This ensures WebUI related objects, specifically
WebUIIOSImpl and the Mojo facade are properly cleaned up.

Additionally, this removes a redundant ClearWebUI call that prematurely
wiped WebUI on any back/forward tap, which is now covered by the new
call added in this CL.

Fixed: 553114676
Change-Id: I6569b1548323b32c5e1f651038e893ac53f0bcfd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8372982
Reviewed-by: Mike Dougherty <[email protected]>
Commit-Queue: Alexandra Pereira <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1695416}
---
diff --git a/ios/web/web_state/ui/crw_web_controller.mm b/ios/web/web_state/ui/crw_web_controller.mm
index 42f523d..f77e9ec8 100644
--- a/ios/web/web_state/ui/crw_web_controller.mm
+++ b/ios/web/web_state/ui/crw_web_controller.mm
@@ -799,8 +799,6 @@
       break;
   }
 
-  self.webStateImpl->ClearWebUI();
-
   // This navigation can be an iframe navigation, but it's not possible to
   // distinguish it from the main frame navigation, so context still has to be
   // created.
diff --git a/ios/web/web_state/web_state_impl_realized_web_state.mm b/ios/web/web_state/web_state_impl_realized_web_state.mm
index f3eb982..3b0ff0c 100644
--- a/ios/web/web_state/web_state_impl_realized_web_state.mm
+++ b/ios/web/web_state/web_state_impl_realized_web_state.mm
@@ -321,6 +321,13 @@
     return;
   }
 
+  // Clear provisional WebUI if the navigation was cancelled/failed, or if it
+  // committed to a non-WebUI page.
+  if (web_ui_ && (!context->HasCommitted() ||
+                  !web::GetWebClient()->IsAppSpecificURL(context->GetUrl()))) {
+    ClearWebUI();
+  }
+
   const bool same_document = context->IsSameDocument();
   base::WeakPtr<NavigationContextImpl> weak_context = context->GetWeakPtr();
   for (auto& observer : observers()) {
diff --git a/ios/web/webui/web_ui_inttest.mm b/ios/web/webui/web_ui_inttest.mm
index 1702d5c24..baeb296e 100644
--- a/ios/web/webui/web_ui_inttest.mm
+++ b/ios/web/webui/web_ui_inttest.mm
@@ -9,6 +9,7 @@
 #import "base/run_loop.h"
 #import "base/test/ios/wait_util.h"
 #import "ios/web/grit/ios_web_resources.h"
+#import "ios/web/navigation/navigation_context_impl.h"
 #import "ios/web/public/navigation/navigation_manager.h"
 #import "ios/web/public/test/navigation_test_util.h"
 #import "ios/web/public/test/web_test_with_web_state.h"
@@ -149,4 +150,38 @@
   ASSERT_TRUE(WebStateImpl::FromWebState(web_state())->HasWebUI());
 }
 
+// Tests that WebUI is cleared if a subsequent navigation fails to commit.
+TEST_F(WebUITest, WebUIClearedOnFailedNavigation) {
+  WebStateImpl* web_state_impl = WebStateImpl::FromWebState(web_state());
+  ASSERT_TRUE(web_state_impl->HasWebUI());
+
+  // Simulate a navigation that cancels or fails before committing.
+  std::unique_ptr<NavigationContextImpl> context =
+      NavigationContextImpl::CreateNavigationContext(
+          web_state(), GURL("testwebui://testwebui2"),
+          /*has_user_gesture=*/true, ui::PAGE_TRANSITION_TYPED,
+          /*is_renderer_initiated=*/false);
+  context->SetHasCommitted(false);
+  web_state_impl->OnNavigationFinished(context.get());
+
+  // WebUI must be cleared.
+  EXPECT_FALSE(web_state_impl->HasWebUI());
+}
+
+TEST_F(WebUITest, WebUIClearedOnNavigatingToNonWebUIPage) {
+  WebStateImpl* web_state_impl = WebStateImpl::FromWebState(web_state());
+  ASSERT_TRUE(web_state_impl->HasWebUI());
+
+  // Navigation successfully to a regular, non-WebUI webpage.
+  std::unique_ptr<NavigationContextImpl> context =
+      NavigationContextImpl::CreateNavigationContext(
+          web_state(), GURL("https://www.google.com"),
+          /*has_user_gesture=*/true, ui::PAGE_TRANSITION_LINK,
+          /*is_renderer_initiated=*/false);
+  context->SetHasCommitted(true);
+  web_state_impl->OnNavigationFinished(context.get());
+
+  // WebUI must be cleared.
+  EXPECT_FALSE(web_state_impl->HasWebUI());
+}
 }  // namespace web