From 04f75457614211264dc142a21265ab212be9d463 Mon Sep 17 00:00:00 2001
From: Quentin Pubert <qpubert@google.com>
Date: Tue, 23 Jun 2026 02:09:41 -0700
Subject: [PATCH] [iOS] Reset last ChooseFileEvent when a navigation commits

ChooseFileTabHelper clears `last_choose_file_event_` in
DidStartNavigation, but the outgoing document can keep running script
while the navigation is pending and set a new event before the new
document commits. That event would then be consumed by RunOpenPanel for
the newly committed document.

Override DidFinishNavigation and reset the stored event again for
committed cross-document navigations so it cannot leak across documents.
Same-document and uncommitted navigations leave the event untouched.

Fixed: 518080978
Change-Id: Ife977488b06719212a3c22b722530cfc621d50bc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7978537
Auto-Submit: Quentin Pubert <qpubert@google.com>
Commit-Queue: Quentin Pubert <qpubert@google.com>
Reviewed-by: Olivier Robin <olivierrobin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1650865}
---

diff --git a/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper.h b/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper.h
index 2f10e72..36f36cf 100644
--- a/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper.h
+++ b/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper.h
@@ -93,6 +93,8 @@
   // web::WebStateObserver implementation.
   void DidStartNavigation(web::WebState* web_state,
                           web::NavigationContext* navigation_context) override;
+  void DidFinishNavigation(web::WebState* web_state,
+                           web::NavigationContext* navigation_context) override;
   void WasHidden(web::WebState* web_state) override;
   void WebStateDestroyed(web::WebState* web_state) override;
 
@@ -129,6 +131,9 @@
   // Latest `ChooseFileEvent` received from JavaScript.
   std::optional<ChooseFileEvent> last_choose_file_event_;
 
+  // Whether a cross-document navigation is currently pending.
+  bool is_pending_navigation_ = false;
+
   // Handler to show/hide the file upload panel UI.
   __weak id<FileUploadPanelCommands> file_upload_panel_handler_ = nil;
 
diff --git a/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper.mm b/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper.mm
index 33c1ff3..ac6d041c 100644
--- a/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper.mm
+++ b/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper.mm
@@ -91,9 +91,11 @@
   CHECK(base::FeatureList::IsEnabled(kIOSCustomFileUploadMenu));
 
   web::WebState* web_state = observation_.GetSource();
-  if (!web_state || web_state->IsBeingDestroyed() || !web_state->IsVisible()) {
+  if (!web_state || web_state->IsBeingDestroyed() || !web_state->IsVisible() ||
+      is_pending_navigation_) {
     // If there is no WebState anymore, or it is being destroyed or not shown,
-    // then call the completion with no selection and return.
+    // or a navigation is pending, then call the completion with no selection
+    // and return.
     std::move(completion).Run(nil);
     return;
   }
@@ -157,6 +159,9 @@
 }
 
 void ChooseFileTabHelper::SetLastChooseFileEvent(ChooseFileEvent event) {
+  if (is_pending_navigation_) {
+    return;
+  }
   last_choose_file_event_ = std::move(event);
 }
 
@@ -230,11 +235,27 @@
     web::WebState* web_state,
     web::NavigationContext* navigation_context) {
   if (!navigation_context->IsSameDocument()) {
+    is_pending_navigation_ = true;
     AbortSelection();
     ResetLastChooseFileEvent();
   }
 }
 
+void ChooseFileTabHelper::DidFinishNavigation(
+    web::WebState* web_state,
+    web::NavigationContext* navigation_context) {
+  if (navigation_context->IsSameDocument()) {
+    return;
+  }
+  is_pending_navigation_ = false;
+  if (navigation_context->HasCommitted()) {
+    // The outgoing document can keep running script after `DidStartNavigation`
+    // and may set a new event before this navigation commits. Reset the event
+    // again so it is not associated with the newly committed document.
+    ResetLastChooseFileEvent();
+  }
+}
+
 void ChooseFileTabHelper::WasHidden(web::WebState* web_state) {
   AbortSelection();
   ResetLastChooseFileEvent();
diff --git a/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper_unittest.mm b/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper_unittest.mm
index aff35102..619fb27b 100644
--- a/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper_unittest.mm
+++ b/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper_unittest.mm
@@ -217,6 +217,56 @@
   EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());
 }
 
+// Tests that file events and panel presentation requests are ignored while a
+// cross-document navigation is pending across documents.
+TEST_F(ChooseFileTabHelperTest, PendingNavigationIgnoresChooseFileEvent) {
+  EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());
+
+  ChooseFileEvent event = ChooseFileEvent::Builder()
+                              .SetAllowMultipleFiles(false)
+                              .SetHasSelectedFile(false)
+                              .SetWebState(web_state_.get())
+                              .Build();
+
+  auto navigation_context = std::make_unique<web::FakeNavigationContext>();
+  navigation_context->SetIsSameDocument(false);
+  tab_helper_->DidStartNavigation(web_state_.get(), navigation_context.get());
+  EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());
+
+  // The outgoing document attempts to set a new event while the navigation is
+  // pending. It should be ignored.
+  tab_helper_->SetLastChooseFileEvent(event);
+  EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());
+
+  if (@available(iOS 18.4, *)) {
+    base::test::ScopedFeatureList feature_list;
+    feature_list.InitAndEnableFeature(kIOSCustomFileUploadMenu);
+
+    id parameters = [OCMockObject mockForClass:[WKOpenPanelParameters class]];
+    __block bool completion_called = false;
+    tab_helper_->RunOpenPanel(parameters, /*frame=*/nil,
+                              base::BindOnce(^(NSArray<NSURL*>* result_urls) {
+                                completion_called = true;
+                                EXPECT_NSEQ(nil, result_urls);
+                              }));
+    EXPECT_TRUE(completion_called);
+    EXPECT_FALSE(tab_helper_->IsChoosingFiles());
+  }
+
+  // Uncommitted cross-document navigation finishes. Storing events should work
+  // again.
+  navigation_context->SetHasCommitted(false);
+  tab_helper_->DidFinishNavigation(web_state_.get(), navigation_context.get());
+  tab_helper_->SetLastChooseFileEvent(event);
+  EXPECT_TRUE(tab_helper_->HasLastChooseFileEvent());
+
+  // Committed cross-document navigation should reset last_choose_file_event_.
+  navigation_context->SetIsSameDocument(false);
+  navigation_context->SetHasCommitted(true);
+  tab_helper_->DidStartNavigation(web_state_.get(), navigation_context.get());
+  EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());
+}
+
 // Tests that hiding the tab resets the last ChooseFileEvent.
 TEST_F(ChooseFileTabHelperTest, WasHiddenResetsLastChooseFileEvent) {
   EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());

diff --git a/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper_unittest.mm b/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper_unittest.mm
index aff35102..619fb27b 100644
--- a/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper_unittest.mm
+++ b/ios/chrome/browser/web/model/choose_file/choose_file_tab_helper_unittest.mm
@@ -217,6 +217,56 @@
   EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());
 }
 
+// Tests that file events and panel presentation requests are ignored while a
+// cross-document navigation is pending across documents.
+TEST_F(ChooseFileTabHelperTest, PendingNavigationIgnoresChooseFileEvent) {
+  EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());
+
+  ChooseFileEvent event = ChooseFileEvent::Builder()
+                              .SetAllowMultipleFiles(false)
+                              .SetHasSelectedFile(false)
+                              .SetWebState(web_state_.get())
+                              .Build();
+
+  auto navigation_context = std::make_unique<web::FakeNavigationContext>();
+  navigation_context->SetIsSameDocument(false);
+  tab_helper_->DidStartNavigation(web_state_.get(), navigation_context.get());
+  EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());
+
+  // The outgoing document attempts to set a new event while the navigation is
+  // pending. It should be ignored.
+  tab_helper_->SetLastChooseFileEvent(event);
+  EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());
+
+  if (@available(iOS 18.4, *)) {
+    base::test::ScopedFeatureList feature_list;
+    feature_list.InitAndEnableFeature(kIOSCustomFileUploadMenu);
+
+    id parameters = [OCMockObject mockForClass:[WKOpenPanelParameters class]];
+    __block bool completion_called = false;
+    tab_helper_->RunOpenPanel(parameters, /*frame=*/nil,
+                              base::BindOnce(^(NSArray<NSURL*>* result_urls) {
+                                completion_called = true;
+                                EXPECT_NSEQ(nil, result_urls);
+                              }));
+    EXPECT_TRUE(completion_called);
+    EXPECT_FALSE(tab_helper_->IsChoosingFiles());
+  }
+
+  // Uncommitted cross-document navigation finishes. Storing events should work
+  // again.
+  navigation_context->SetHasCommitted(false);
+  tab_helper_->DidFinishNavigation(web_state_.get(), navigation_context.get());
+  tab_helper_->SetLastChooseFileEvent(event);
+  EXPECT_TRUE(tab_helper_->HasLastChooseFileEvent());
+
+  // Committed cross-document navigation should reset last_choose_file_event_.
+  navigation_context->SetIsSameDocument(false);
+  navigation_context->SetHasCommitted(true);
+  tab_helper_->DidStartNavigation(web_state_.get(), navigation_context.get());
+  EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());
+}
+
 // Tests that hiding the tab resets the last ChooseFileEvent.
 TEST_F(ChooseFileTabHelperTest, WasHiddenResetsLastChooseFileEvent) {
   EXPECT_FALSE(tab_helper_->HasLastChooseFileEvent());