From 2a8aa60275ec21a9db85e25bed582697aeea9dd8 Mon Sep 17 00:00:00 2001
From: Maria Kazinova <kazinova@google.com>
Date: Mon, 01 Jun 2026 05:20:56 -0700
Subject: [PATCH] [Passwords] Prevent crashes on detached frame in PasswordAutofillAgent

Description: This CL adds checks to ensure render_frame() is valid
before accessing it in PasswordAutofillAgent. During filling
operations, script execution can cause the frame to be detached. If
destruction of the agent is delayed (e.g., during nested loops like
printing), subsequent accesses to the detached frame can cause crashes.

NO_IFTTT=Crash fix on non-iOS, no need to update iOS code.

Fixed: 516819850
Change-Id: I7cf1b25f90b42e6601e9099768c1bedab3773e88
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7883070
Commit-Queue: Maria Kazinova <kazinova@google.com>
Reviewed-by: Ioana Treib <ioanap@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1639311}
---

diff --git a/components/autofill/content/renderer/password_autofill_agent.cc b/components/autofill/content/renderer/password_autofill_agent.cc
index 41594d4..d04663d4c 100644
--- a/components/autofill/content/renderer/password_autofill_agent.cc
+++ b/components/autofill/content/renderer/password_autofill_agent.cc
@@ -759,6 +759,9 @@
   if (element && !element.SuggestedValue().IsEmpty()) {
     element.SetAutofillValue(element.SuggestedValue());
   }
+  // WARNING: SetAutofillValue can trigger JS that detaches the frame.
+  // Do not add code here that assumes the frame is still valid without
+  // checking.
 }
 
 std::optional<PasswordSuggestionRequest>
@@ -776,6 +779,10 @@
 void PasswordAutofillAgent::NotifyPasswordManagerAboutUserFieldModification(
     const WebInputElement& element,
     FieldModificationType modification_type) {
+  // No need to post a notification if the frame has already detached.
+  if (!render_frame()) {
+    return;
+  }
   if (element.FormControlTypeForAutofill() == kInputPassword) {
     auto iter = password_to_username_.find(FieldRef(element));
     if ((iter != password_to_username_.end()) &&
@@ -1045,6 +1052,11 @@
                                         FieldPropertiesMask field_properties) {
   CHECK(input);
   input.SetAutofillValue(WebString::FromUtf16(credential));
+  // No need to process changes if the frame has detached upon filling
+  // completion.
+  if (!render_frame()) {
+    return;
+  }
   field_data_manager().UpdateFieldDataMap(form_util::GetFieldRendererId(input),
                                           credential, field_properties);
 
@@ -1145,6 +1157,9 @@
     const WebInputElement& user_input,
     AutofillSuggestionTriggerSource trigger_source,
     const SynchronousFormCache& form_cache) {
+  if (!render_frame()) {
+    return std::nullopt;
+  }
   base::UmaHistogramEnumeration("PasswordManager.SuggestionPopupTriggerSource",
                                 trigger_source);
   // TODO(crbug.com/408843433): Don't extract the data here but pass it in from
@@ -1191,7 +1206,7 @@
   DCHECK(username_element && password_element && password_info);
   username_element->Reset();
   password_element->Reset();
-  if (!element) {
+  if (!element || !render_frame()) {
     return false;
   }
   if (suggestion_banned_fields_.contains(GetFieldRendererId(element))) {
@@ -1301,6 +1316,9 @@
     return;
 
   checked_safe_browsing_reputation_ = true;
+  if (!render_frame()) {
+    return;
+  }
   WebLocalFrame* frame = render_frame()->GetWebFrame();
   GURL frame_url = GURL(frame->GetDocument().Url());
   WebFormElement form_element = element.GetOwningFormForAutofill();
@@ -1312,6 +1330,9 @@
 }
 
 bool PasswordAutofillAgent::FrameCanAccessPasswordManager() {
+  if (!render_frame()) {
+    return false;
+  }
   // about:blank or about:srcdoc frames should not be allowed to use password
   // manager.  See https://crbug.com/756587.
   WebLocalFrame* frame = render_frame()->GetWebFrame();
@@ -1386,6 +1407,9 @@
     logger->LogBoolean(Logger::STRING_ONLY_VISIBLE, only_visible);
   }
 
+  if (!render_frame()) {
+    return;
+  }
   WebLocalFrame* frame = render_frame()->GetWebFrame();
 
   // Make sure that this security origin is allowed to use password manager.
@@ -1534,7 +1558,8 @@
 }
 
 bool PasswordAutofillAgent::IsPrerendering() const {
-  return render_frame()->GetWebFrame()->GetDocument().IsPrerendering();
+  return render_frame() &&
+         render_frame()->GetWebFrame()->GetDocument().IsPrerendering();
 }
 
 bool PasswordAutofillAgent::IsUsernameInputField(
@@ -1553,6 +1578,9 @@
     logger->LogMessage(Logger::STRING_DID_START_PROVISIONAL_LOAD_METHOD);
   }
 
+  if (!render_frame()) {
+    return;
+  }
   WebLocalFrame* navigated_frame = render_frame()->GetWebFrame();
   if (navigated_frame->IsOutermostMainFrame()) {
     // This is a new navigation, so require a new user gesture before filling in
@@ -2127,6 +2155,7 @@
 
   // Lazily bind this interface.
   if (!password_manager_driver_) {
+    CHECK(render_frame());
     render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(
         &password_manager_driver_);
   }