From 2a4a6bfdb0f89d2da863599e637e6dc1ed7e78df Mon Sep 17 00:00:00 2001
From: Luis Antunes <luisantunes@google.com>
Date: Fri, 03 Jul 2026 08:13:20 -0700
Subject: [PATCH] [Autofill] Clear native pointer in name fix-flow bridge

AutofillNameFixFlowBridge held its native pointer in a final field, so
it could not be cleared once PromptDismissed deleted the C++
counterpart. A late delegate callback (e.g. via the soft-keyboard Done
action that calls onClick directly) would then forward a stale pointer
to JNI.

Mirror AutofillExpirationDateFixFlowBridge / CardUnmaskBridge: drop
final, zero the pointer in onPromptDismissed and skip
onUserAcceptCardholderName / onUserDismiss / onPromptDismissed when it
is 0. Relax the constructor to @VisibleForTesting package visibility and
add Robolectric coverage.

Fixed: 520540744
Change-Id: I8d4fc04946ecc8f798f72213a4c83c57f41fddbf
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8029643
Commit-Queue: Luis Antunes <luisantunes@google.com>
Reviewed-by: Luchen Peng <luchenpeng@google.com>
Reviewed-by: Slobodan Pejic <slobodan@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1656587}
---

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillNameFixFlowBridge.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillNameFixFlowBridge.java
index 8c8ae3f..95db3046 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillNameFixFlowBridge.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillNameFixFlowBridge.java
@@ -8,6 +8,8 @@
 
 import android.app.Activity;
 
+import androidx.annotation.VisibleForTesting;
+
 import org.jni_zero.CalledByNative;
 import org.jni_zero.JNINamespace;
 import org.jni_zero.JniType;
@@ -25,7 +27,7 @@
 @JNINamespace("autofill")
 @NullMarked
 final class AutofillNameFixFlowBridge implements AutofillNameFixFlowPromptDelegate {
-    private final long mNativeCardNameFixFlowViewAndroid;
+    private long mNativeCardNameFixFlowViewAndroid;
     private final @Nullable Activity mActivity;
     private final String mTitle;
     private final String mInferredName;
@@ -33,7 +35,8 @@
     private final int mIconId;
     private @Nullable AutofillNameFixFlowPrompt mNameFixFlowPrompt;
 
-    private AutofillNameFixFlowBridge(
+    @VisibleForTesting
+    AutofillNameFixFlowBridge(
             long nativeCardNameFixFlowViewAndroid,
             String title,
             String inferredName,
@@ -74,16 +77,25 @@
 
     @Override
     public void onPromptDismissed() {
-        AutofillNameFixFlowBridgeJni.get().promptDismissed(mNativeCardNameFixFlowViewAndroid);
+        if (mNativeCardNameFixFlowViewAndroid == 0) return;
+        long nativePtr = mNativeCardNameFixFlowViewAndroid;
+        // The native pointer is zeroed out here before calling promptDismissed to ensure
+        // that any subsequent UI events triggered during the dismissal flow (like focus
+        // changes or text watcher events) are dropped instead of attempting to call
+        // JNI methods on a dangling pointer.
+        mNativeCardNameFixFlowViewAndroid = 0;
+        AutofillNameFixFlowBridgeJni.get().promptDismissed(nativePtr);
     }
 
     @Override
     public void onUserDismiss() {
+        if (mNativeCardNameFixFlowViewAndroid == 0) return;
         AutofillNameFixFlowBridgeJni.get().onUserDismiss(mNativeCardNameFixFlowViewAndroid);
     }
 
     @Override
     public void onUserAcceptCardholderName(String name) {
+        if (mNativeCardNameFixFlowViewAndroid == 0) return;
         AutofillNameFixFlowBridgeJni.get().onUserAccept(mNativeCardNameFixFlowViewAndroid, name);
     }
 
diff --git a/chrome/android/junit/BUILD.gn b/chrome/android/junit/BUILD.gn
index 5f565ac4..57751957 100644
--- a/chrome/android/junit/BUILD.gn
+++ b/chrome/android/junit/BUILD.gn
@@ -506,6 +506,7 @@
       "src/org/chromium/chrome/browser/autofill/AutofillFallbackSurfaceLauncherTest.java",
       "src/org/chromium/chrome/browser/autofill/AutofillImageFetcherTest.java",
       "src/org/chromium/chrome/browser/autofill/AutofillImageFetcherUtilsTest.java",
+      "src/org/chromium/chrome/browser/autofill/AutofillNameFixFlowBridgeTest.java",
       "src/org/chromium/chrome/browser/autofill/AutofillUiUtilsTest.java",
       "src/org/chromium/chrome/browser/autofill/CardUnmaskBridgeTest.java",
       "src/org/chromium/chrome/browser/autofill/GoogleWalletLauncherTest.java",
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/autofill/AutofillNameFixFlowBridgeTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/autofill/AutofillNameFixFlowBridgeTest.java
new file mode 100644
index 0000000..32c1c2a
--- /dev/null
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/autofill/AutofillNameFixFlowBridgeTest.java
@@ -0,0 +1,82 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.autofill;
+
+import static org.mockito.Mockito.verify;
+
+import android.app.Activity;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnit;
+import org.mockito.junit.MockitoRule;
+import org.robolectric.Robolectric;
+
+import org.chromium.base.test.BaseRobolectricTestRunner;
+import org.chromium.ui.base.WindowAndroid;
+
+/** Unit tests for {@link AutofillNameFixFlowBridge}. */
+@RunWith(BaseRobolectricTestRunner.class)
+public class AutofillNameFixFlowBridgeTest {
+    @Rule public MockitoRule mMockitoRule = MockitoJUnit.rule();
+
+    @Mock private AutofillNameFixFlowBridge.Natives mNativeMock;
+
+    private WindowAndroid mWindowAndroid;
+    private AutofillNameFixFlowBridge mBridge;
+    private static final long NATIVE_POINTER = 12345L;
+
+    @Before
+    public void setUp() {
+        AutofillNameFixFlowBridgeJni.setInstanceForTesting(mNativeMock);
+
+        Activity activity = Robolectric.buildActivity(Activity.class).create().get();
+        mWindowAndroid = new WindowAndroid(activity, false);
+
+        mBridge =
+                new AutofillNameFixFlowBridge(
+                        NATIVE_POINTER,
+                        /* title= */ "Title",
+                        /* inferredName= */ "Inferred Name",
+                        /* confirmButtonLabel= */ "Confirm",
+                        /* iconId= */ 0,
+                        mWindowAndroid);
+    }
+
+    @After
+    public void tearDown() {
+        mWindowAndroid.destroy();
+    }
+
+    @Test
+    public void testOnUserDismiss_CallsJni() {
+        mBridge.onUserDismiss();
+        verify(mNativeMock).onUserDismiss(NATIVE_POINTER);
+    }
+
+    @Test
+    public void testOnUserAcceptCardholderName_CallsJni() {
+        mBridge.onUserAcceptCardholderName("New Name");
+        verify(mNativeMock).onUserAccept(NATIVE_POINTER, "New Name");
+    }
+
+    @Test
+    public void testOnPromptDismissed_CallsJniAndClearsPointer() {
+        mBridge.onPromptDismissed();
+        verify(mNativeMock).promptDismissed(NATIVE_POINTER);
+
+        // Subsequent calls should not reach JNI.
+        mBridge.onUserDismiss();
+        mBridge.onUserAcceptCardholderName("New Name");
+        mBridge.onPromptDismissed();
+
+        // Verify no other calls were made to JNI after the first dismiss.
+        org.mockito.Mockito.verifyNoMoreInteractions(mNativeMock);
+    }
+}