From 60a432d27fbf9b047b99035179d7d4d767a53f06 Mon Sep 17 00:00:00 2001
From: Jean-Francois Le <jfle@google.com>
Date: Mon, 27 Apr 2026 06:19:28 -0700
Subject: [PATCH] [iOS] Use WeakPtr for webStateList in manual filling

Fixed: 505191883
Change-Id: Ic9747a0d340b1d354a320dde97c4da341947039f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7786010
Reviewed-by: Vincent Boisselle <vincb@google.com>
Reviewed-by: Tommy Martino <tmartino@chromium.org>
Commit-Queue: Jean-François Le <jfle@google.com>
Cr-Commit-Position: refs/heads/main@{#1621040}
---

diff --git a/ios/chrome/browser/autofill/ui_bundled/manual_fill/manual_fill_injection_handler.mm b/ios/chrome/browser/autofill/ui_bundled/manual_fill/manual_fill_injection_handler.mm
index d3b73938..bc930d2 100644
--- a/ios/chrome/browser/autofill/ui_bundled/manual_fill/manual_fill_injection_handler.mm
+++ b/ios/chrome/browser/autofill/ui_bundled/manual_fill/manual_fill_injection_handler.mm
@@ -77,9 +77,6 @@
 // hardware for authentication is available.
 @property(nonatomic, strong) ReauthenticationModule* reauthenticationModule;
 
-// The WebStateList with the relevant active web state for the injection.
-@property(nonatomic, assign) WebStateList* webStateList;
-
 // YES if the last focused element is secure within its web frame. To be secure
 // means the web is HTTPS and the URL is trusted.
 @property(nonatomic, assign, getter=isLastFocusedElementSecure)
@@ -109,6 +106,9 @@
   // given `webState`. This is there to solve a dependency cycle between model/
   // and ui_bundled/.
   AutofillProviderGetter _autofillProviderGetter;
+
+  // The WebStateList with the relevant active web state for the injection.
+  base::WeakPtr<WebStateList> _webStateList;
 }
 
 - (instancetype)
@@ -119,7 +119,7 @@
     autofillProviderGetter:(AutofillProviderGetter)autofillProviderGetter {
   self = [super init];
   if (self) {
-    _webStateList = webStateList;
+    _webStateList = webStateList->AsWeakPtr();
     _securityAlertHandler = securityAlertHandler;
     _formHelper =
         [[FormObserverHelper alloc] initWithWebStateList:webStateList];
@@ -195,9 +195,10 @@
                       shouldReauth:(BOOL)shouldReauth {
   if (shouldReauth && [self.reauthenticationModule canAttemptReauth]) {
     NSString* reason = l10n_util::GetNSString(IDS_IOS_AUTOFILL_REAUTH_REASON);
+    __weak __typeof(self) weakSelf = self;
     auto completionHandler = ^(ReauthenticationResult result) {
       if (result != ReauthenticationResult::kFailure) {
-        [self fillFormWithCredential:credential];
+        [weakSelf fillFormWithCredential:credential];
       }
     };
 
@@ -236,7 +237,10 @@
 }
 
 - (BOOL)isActiveFormAPasswordForm {
-  web::WebState* activeWebState = self.webStateList->GetActiveWebState();
+  if (!_webStateList) {
+    return NO;
+  }
+  web::WebState* activeWebState = _webStateList->GetActiveWebState();
   if (!activeWebState) {
     return NO;
   }
@@ -285,7 +289,10 @@
 
 // Injects the passed string to the active field and jumps to the next field.
 - (void)fillLastSelectedFieldWithString:(NSString*)string {
-  web::WebState* activeWebState = self.webStateList->GetActiveWebState();
+  if (!_webStateList) {
+    return;
+  }
+  web::WebState* activeWebState = _webStateList->GetActiveWebState();
   if (!activeWebState) {
     return;
   }
@@ -300,9 +307,10 @@
   data.Set("renderer_id",
            static_cast<int>([self lastFocusedElementUniqueID].value()));
   data.Set("value", base::SysNSStringToUTF16(string));
+  __weak __typeof(self) weakSelf = self;
   autofill::AutofillJavaScriptFeature::GetInstance()->FillActiveFormField(
       activeWebFrame, std::move(data), base::BindOnce(^(BOOL success) {
-        [self jumpToNextField];
+        [weakSelf jumpToNextField];
       }));
 }
 
@@ -310,7 +318,10 @@
 - (void)jumpToNextField {
   FormInputAccessoryViewHandler* handler =
       [[FormInputAccessoryViewHandler alloc] init];
-  handler.webState = self.webStateList->GetActiveWebState();
+  if (!_webStateList) {
+    return;
+  }
+  handler.webState = _webStateList->GetActiveWebState();
   [handler setLastFocusFormActivityWebFrameID:
                base::SysUTF8ToNSString(self.lastFocusedElementFrameIdentifier)];
   [handler selectNextElementWithoutButtonPress];
@@ -319,7 +330,10 @@
 // Fills the current form with the given `credential`. Only works if the current
 // form is a password form, otherwise it's a no-op.
 - (void)fillFormWithCredential:(ManualFillCredential*)credential {
-  web::WebState* activeWebState = self.webStateList->GetActiveWebState();
+  if (!_webStateList) {
+    return;
+  }
+  web::WebState* activeWebState = _webStateList->GetActiveWebState();
   if (!activeWebState) {
     return;
   }
@@ -451,7 +465,10 @@
 - (id<FormSuggestionProvider>)providerForSuggestion:
     (FormSuggestion*)suggestion {
   if (IsSupportedSuggestion(suggestion)) {
-    return _autofillProviderGetter.Run(self.webStateList->GetActiveWebState());
+    if (!_webStateList) {
+      return nil;
+    }
+    return _autofillProviderGetter.Run(_webStateList->GetActiveWebState());
   }
 
   // The manual fill injector should not use Suggestion objects for any other