Fix Android activity result callback leak

[AdamEssenmacher]

Description of Change

Updates Android ActivityResultCallbackRegistry so activity result callbacks are consumed exactly once when a result is delivered.

InvokeCallback now removes the registered callback before invoking it. This prevents completed WebView file chooser callbacks from remaining rooted in the static registry after cancelled or completed chooser flows, allowing captured IValueCallback instances to be collected.

No public API changes.

Added Android device tests covering:

• registered callback invocation
• one-shot callback consumption
• removal before exception propagation
• unknown request code no-op behavior
• explicit unregister behavior

Verification:

• Built Core.DeviceTests for net10.0-android
• Ran Android WebView-category device tests locally
• Confirmed all 5 added ActivityResultCallbackRegistryTests passed

Issues Fixed

Fixes #35405

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 35436

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 35436"

[dotnet-policy-service]

Hey there @@AdamEssenmacher! Thank you so much for your PR! Someone from the team will get assigned to your PR shortly and we'll get it reviewed.

[MauiBot]

🤖 AI Summary

👋 @AdamEssenmacher — new AI review results are available. Please review the latest session below.

📊 Review Session — 566c514 · Fix Android activity result callback leak · 2026-05-14 11:09 UTC

🚦 Gate — Test Before & After Fix

Gate Result: ✅ PASSED

Platform: ANDROID · Base: main · Merge base: 4f61d650

Test	Without Fix (expect FAIL)	With Fix (expect PASS)
📱 ActivityResultCallbackRegistryTests (InvokeCallbackIgnoresUnknownRequestCode, InvokeCallbackInvokesRegisteredCallback, InvokeCallbackConsumesRegisteredCallback, InvokeCallbackRemovesCallbackBeforePropagatingException, UnregisterActivityResultCallbackPreventsInvocation) Category=WebView	✅ FAIL — 948s	✅ PASS — 346s

🔴 Without fix — 📱 ActivityResultCallbackRegistryTests (InvokeCallbackIgnoresUnknownRequestCode, InvokeCallbackInvokesRegisteredCallback, InvokeCallbackConsumesRegisteredCallback, InvokeCallbackRemovesCallbackBeforePropagatingException, UnregisterActivityResultCallbackPreventsInvocation): FAIL ✅ · 948s

(truncated to last 15,000 chars)

arin.AndroidX.Collection.Jvm.dll.so
  [113/128] System.Text.Encodings.Web.dll -> System.Text.Encodings.Web.dll.so
  [36/128] Xamarin.AndroidX.CoordinatorLayout.dll -> Xamarin.AndroidX.CoordinatorLayout.dll.so
  [37/128] Xamarin.AndroidX.Core.dll -> Xamarin.AndroidX.Core.dll.so
  [38/128] Xamarin.AndroidX.CursorAdapter.dll -> Xamarin.AndroidX.CursorAdapter.dll.so
  [114/128] System.Text.RegularExpressions.dll -> System.Text.RegularExpressions.dll.so
  [39/128] Xamarin.AndroidX.CustomView.dll -> Xamarin.AndroidX.CustomView.dll.so
  [115/128] System.Threading.Tasks.dll -> System.Threading.Tasks.dll.so
  [40/128] Xamarin.AndroidX.DrawerLayout.dll -> Xamarin.AndroidX.DrawerLayout.dll.so
  [116/128] System.Threading.Thread.dll -> System.Threading.Thread.dll.so
  [117/128] System.Text.Json.dll -> System.Text.Json.dll.so
  [41/128] Xamarin.AndroidX.Fragment.dll -> Xamarin.AndroidX.Fragment.dll.so
  [118/128] System.Threading.ThreadPool.dll -> System.Threading.ThreadPool.dll.so
  [119/128] System.Threading.dll -> System.Threading.dll.so
  [120/128] System.Xml.Linq.dll -> System.Xml.Linq.dll.so
  [42/128] Xamarin.AndroidX.Lifecycle.Common.Jvm.dll -> Xamarin.AndroidX.Lifecycle.Common.Jvm.dll.so
  [121/128] System.Xml.ReaderWriter.dll -> System.Xml.ReaderWriter.dll.so
  [122/128] System.Xml.XDocument.dll -> System.Xml.XDocument.dll.so
  [43/128] Xamarin.AndroidX.Lifecycle.LiveData.Core.dll -> Xamarin.AndroidX.Lifecycle.LiveData.Core.dll.so
  [123/128] System.dll -> System.dll.so
  [124/128] netstandard.dll -> netstandard.dll.so
  [44/128] Xamarin.AndroidX.Lifecycle.ViewModel.Android.dll -> Xamarin.AndroidX.Lifecycle.ViewModel.Android.dll.so
  [125/128] Mono.Android.Runtime.dll -> Mono.Android.Runtime.dll.so
  [45/128] Xamarin.AndroidX.Lifecycle.ViewModelSavedState.Android.dll -> Xamarin.AndroidX.Lifecycle.ViewModelSavedState.Android.dll.so
  [126/128] Java.Interop.dll -> Java.Interop.dll.so
  [46/128] Xamarin.AndroidX.Loader.dll -> Xamarin.AndroidX.Loader.dll.so
  [47/128] Xamarin.AndroidX.Navigation.Common.Android.dll -> Xamarin.AndroidX.Navigation.Common.Android.dll.so
  [48/128] Xamarin.AndroidX.Navigation.Fragment.dll -> Xamarin.AndroidX.Navigation.Fragment.dll.so
  [49/128] Xamarin.AndroidX.Navigation.Runtime.Android.dll -> Xamarin.AndroidX.Navigation.Runtime.Android.dll.so
  [50/128] Xamarin.AndroidX.Navigation.UI.dll -> Xamarin.AndroidX.Navigation.UI.dll.so
  [51/128] Xamarin.AndroidX.RecyclerView.dll -> Xamarin.AndroidX.RecyclerView.dll.so
  [52/128] Xamarin.AndroidX.SavedState.SavedState.Android.dll -> Xamarin.AndroidX.SavedState.SavedState.Android.dll.so
  [127/128] Mono.Android.dll -> Mono.Android.dll.so
  [53/128] Xamarin.AndroidX.SwipeRefreshLayout.dll -> Xamarin.AndroidX.SwipeRefreshLayout.dll.so
  [54/128] Xamarin.AndroidX.ViewPager.dll -> Xamarin.AndroidX.ViewPager.dll.so
  [55/128] Xamarin.AndroidX.ViewPager2.dll -> Xamarin.AndroidX.ViewPager2.dll.so
  [56/128] Xamarin.Google.Android.Material.dll -> Xamarin.Google.Android.Material.dll.so
  [57/128] Xamarin.Kotlin.StdLib.dll -> Xamarin.Kotlin.StdLib.dll.so
  [58/128] Xamarin.KotlinX.Coroutines.Core.Jvm.dll -> Xamarin.KotlinX.Coroutines.Core.Jvm.dll.so
  [59/128] Xamarin.KotlinX.Serialization.Core.Jvm.dll -> Xamarin.KotlinX.Serialization.Core.Jvm.dll.so
  [60/128] xunit.abstractions.dll -> xunit.abstractions.dll.so
  [61/128] xunit.assert.dll -> xunit.assert.dll.so
  [62/128] xunit.core.dll -> xunit.core.dll.so
  [63/128] xunit.execution.dotnet.dll -> xunit.execution.dotnet.dll.so
  [64/128] xunit.runner.utility.netcoreapp10.dll -> xunit.runner.utility.netcoreapp10.dll.so
  [65/128] System.Collections.Concurrent.dll -> System.Collections.Concurrent.dll.so
  [66/128] System.Collections.Immutable.dll -> System.Collections.Immutable.dll.so
  [67/128] System.Collections.NonGeneric.dll -> System.Collections.NonGeneric.dll.so
  [68/128] System.Collections.Specialized.dll -> System.Collections.Specialized.dll.so
  [69/128] System.Collections.dll -> System.Collections.dll.so
  [70/128] System.ComponentModel.Primitives.dll -> System.ComponentModel.Primitives.dll.so
  [71/128] System.ComponentModel.TypeConverter.dll -> System.ComponentModel.TypeConverter.dll.so
  [72/128] System.ComponentModel.dll -> System.ComponentModel.dll.so
  [73/128] System.Console.dll -> System.Console.dll.so
  [74/128] System.Diagnostics.Debug.dll -> System.Diagnostics.Debug.dll.so
  [128/128] System.Private.CoreLib.dll -> System.Private.CoreLib.dll.so
  [75/128] System.Diagnostics.DiagnosticSource.dll -> System.Diagnostics.DiagnosticSource.dll.so
  [76/128] System.Diagnostics.Process.dll -> System.Diagnostics.Process.dll.so
  [77/128] System.Diagnostics.Tools.dll -> System.Diagnostics.Tools.dll.so
  [78/128] System.Diagnostics.TraceSource.dll -> System.Diagnostics.TraceSource.dll.so
  [79/128] System.Diagnostics.Tracing.dll -> System.Diagnostics.Tracing.dll.so
  [80/128] System.Drawing.Primitives.dll -> System.Drawing.Primitives.dll.so
  [81/128] System.Drawing.dll -> System.Drawing.dll.so
  [82/128] System.Formats.Asn1.dll -> System.Formats.Asn1.dll.so
  [83/128] System.Globalization.dll -> System.Globalization.dll.so
  [84/128] System.IO.Compression.Brotli.dll -> System.IO.Compression.Brotli.dll.so
  [85/128] System.IO.Compression.dll -> System.IO.Compression.dll.so
  [86/128] System.IO.FileSystem.dll -> System.IO.FileSystem.dll.so
  [87/128] System.IO.Pipelines.dll -> System.IO.Pipelines.dll.so
  [88/128] System.IO.dll -> System.IO.dll.so
  [89/128] System.Linq.Expressions.dll -> System.Linq.Expressions.dll.so
  [90/128] System.Linq.dll -> System.Linq.dll.so
  [91/128] System.Memory.dll -> System.Memory.dll.so
  [92/128] System.Net.Http.dll -> System.Net.Http.dll.so
  [93/128] System.Net.NameResolution.dll -> System.Net.NameResolution.dll.so
  [94/128] System.Net.Primitives.dll -> System.Net.Primitives.dll.so
  [95/128] System.Net.Requests.dll -> System.Net.Requests.dll.so
  [96/128] System.Net.Sockets.dll -> System.Net.Sockets.dll.so
  [97/128] System.Numerics.Vectors.dll -> System.Numerics.Vectors.dll.so
  [98/128] System.ObjectModel.dll -> System.ObjectModel.dll.so
  [99/128] System.Private.Uri.dll -> System.Private.Uri.dll.so
  [100/128] System.Private.Xml.Linq.dll -> System.Private.Xml.Linq.dll.so
  [101/128] System.Private.Xml.dll -> System.Private.Xml.dll.so
  [102/128] System.Reflection.Extensions.dll -> System.Reflection.Extensions.dll.so
  [103/128] System.Reflection.TypeExtensions.dll -> System.Reflection.TypeExtensions.dll.so
  [104/128] System.Reflection.dll -> System.Reflection.dll.so
  [105/128] System.Runtime.Extensions.dll -> System.Runtime.Extensions.dll.so
  [106/128] System.Runtime.InteropServices.RuntimeInformation.dll -> System.Runtime.InteropServices.RuntimeInformation.dll.so
  [107/128] System.Runtime.InteropServices.dll -> System.Runtime.InteropServices.dll.so
  [108/128] System.Runtime.Loader.dll -> System.Runtime.Loader.dll.so
  [109/128] System.Runtime.Numerics.dll -> System.Runtime.Numerics.dll.so
  [110/128] System.Runtime.dll -> System.Runtime.dll.so
  [111/128] System.Security.Cryptography.dll -> System.Security.Cryptography.dll.so
  [112/128] System.Text.Encoding.dll -> System.Text.Encoding.dll.so
  [113/128] System.Text.Encodings.Web.dll -> System.Text.Encodings.Web.dll.so
  [114/128] System.Text.Json.dll -> System.Text.Json.dll.so
  [115/128] System.Text.RegularExpressions.dll -> System.Text.RegularExpressions.dll.so
  [116/128] System.Threading.Tasks.dll -> System.Threading.Tasks.dll.so
  [117/128] System.Threading.Thread.dll -> System.Threading.Thread.dll.so
  [118/128] System.Threading.ThreadPool.dll -> System.Threading.ThreadPool.dll.so
  [119/128] System.Threading.dll -> System.Threading.dll.so
  [120/128] System.Xml.Linq.dll -> System.Xml.Linq.dll.so
  [121/128] System.Xml.ReaderWriter.dll -> System.Xml.ReaderWriter.dll.so
  [122/128] System.Xml.XDocument.dll -> System.Xml.XDocument.dll.so
  [123/128] System.dll -> System.dll.so
  [124/128] netstandard.dll -> netstandard.dll.so
  [125/128] Java.Interop.dll -> Java.Interop.dll.so
  [126/128] Mono.Android.Runtime.dll -> Mono.Android.Runtime.dll.so
  [127/128] Mono.Android.dll -> Mono.Android.dll.so
  [128/128] System.Private.CoreLib.dll -> System.Private.CoreLib.dll.so

Build succeeded.
    0 Warning(s)
    0 Error(s)

Time Elapsed 00:10:01.69
[11.0.0-prerelease.26230.4+92962e5c46ac08a66ded4c5696209cc60f1a232f] XHarness command issued: android test --app /home/vsts/work/1/s/artifacts/bin/Core.DeviceTests/Release/net10.0-android/com.microsoft.maui.core.devicetests-Signed.apk --package-name com.microsoft.maui.core.devicetests --device-id emulator-5554 -o artifacts/log --timeout 01:00:00 -v --arg TestFilter=Category=WebView
�[40m�[37mdbug�[39m�[22m�[49m: ADBRunner using ADB.exe supplied from /home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/tools/net10.0/any/../../../runtimes/any/native/adb/linux/adb
�[40m�[37mdbug�[39m�[22m�[49m: Full resolved path:'/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb'
�[40m�[32minfo�[39m�[22m�[49m: Will attempt to find device supporting architectures: 'arm64-v8a', 'x86_64'
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb start-server'
�[40m�[37mdbug�[39m�[22m�[49m: 
�[40m�[32minfo�[39m�[22m�[49m: Finding attached devices/emulators...
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb devices -l'
�[40m�[37mdbug�[39m�[22m�[49m: Found 1 possible devices
�[40m�[37mdbug�[39m�[22m�[49m: Evaluating output line for device serial: emulator-5554          device product:sdk_gphone_x86_64 model:sdk_gphone_x86_64 device:generic_x86_64_arm64 transport_id:2
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 shell getprop ro.product.cpu.abilist'
�[40m�[37mdbug�[39m�[22m�[49m: Found 1 possible devices. Using 'emulator-5554'
�[40m�[32minfo�[39m�[22m�[49m: Active Android device set to serial 'emulator-5554'
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 -s emulator-5554 shell getprop ro.product.cpu.abi'
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 -s emulator-5554 shell getprop ro.build.version.sdk'
�[40m�[32minfo�[39m�[22m�[49m: Waiting for device to be available (max 5 minutes)
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 wait-for-device'
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 -s emulator-5554 shell getprop sys.boot_completed'
�[40m�[37mdbug�[39m�[22m�[49m: sys.boot_completed = '1'
�[40m�[37mdbug�[39m�[22m�[49m: Waited 0 seconds for device boot completion
�[40m�[37mdbug�[39m�[22m�[49m: Working with emulator-5554 (API 30)
�[40m�[37mdbug�[39m�[22m�[49m: Check current adb install and/or package verification settings
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 shell settings get global verifier_verify_adb_installs'
�[40m�[37mdbug�[39m�[22m�[49m: verifier_verify_adb_installs = 0
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 shell settings get global package_verifier_enable'
�[40m�[37mdbug�[39m�[22m�[49m: package_verifier_enable = 
�[40m�[1m�[33mwarn�[39m�[22m�[49m: Installing debug apks on a device might be rejected with INSTALL_FAILED_VERIFICATION_FAILURE. Make sure to set 'package_verifier_enable' to '0'
�[40m�[32minfo�[39m�[22m�[49m: Attempting to remove apk 'com.microsoft.maui.core.devicetests'..
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 uninstall com.microsoft.maui.core.devicetests'
�[41m�[30mfail�[39m�[22m�[49m: Waiting for command timed out: execution may be compromised
�[41m�[30mfail�[39m�[22m�[49m: Error: Exit code: -2
      Std out:
      
      
      
�[40m�[32minfo�[39m�[22m�[49m: Attempting to install /home/vsts/work/1/s/artifacts/bin/Core.DeviceTests/Release/net10.0-android/com.microsoft.maui.core.devicetests-Signed.apk
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 install /home/vsts/work/1/s/artifacts/bin/Core.DeviceTests/Release/net10.0-android/com.microsoft.maui.core.devicetests-Signed.apk'
�[41m�[30mfail�[39m�[22m�[49m: Error:
      Exit code: 1
      Std out:
      Serving...
      Performing Incremental Install
      cmd: Failure calling service package: Broken pipe (32)
      Performing Streamed Install
      
      
      Std err:
      All files should be loaded. Notifying the device.
      adb: failed to install /home/vsts/work/1/s/artifacts/bin/Core.DeviceTests/Release/net10.0-android/com.microsoft.maui.core.devicetests-Signed.apk: cmd: Can't find service: package
      
      
      
�[41m�[1m�[37mcrit�[39m�[22m�[49m: Install failure: Test command cannot continue
�[40m�[32minfo�[39m�[22m�[49m: Attempting to remove apk 'com.microsoft.maui.core.devicetests'..
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 uninstall com.microsoft.maui.core.devicetests'
�[41m�[30mfail�[39m�[22m�[49m: Error: Exit code: 20
      Std out:
      
      
      Std err:
      cmd: Can't find service: package
      
      
      
�[40m�[32minfo�[39m�[22m�[49m: Attempting to remove apk 'com.microsoft.maui.core.devicetests'..
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 uninstall com.microsoft.maui.core.devicetests'
�[41m�[30mfail�[39m�[22m�[49m: Error: Exit code: 20
      Std out:
      
      
      Std err:
      cmd: Can't find service: package
      
      
      
XHarness exit code: 78 (PACKAGE_INSTALLATION_FAILURE)
  Tests completed with exit code: 78

🟢 With fix — 📱 ActivityResultCallbackRegistryTests (InvokeCallbackIgnoresUnknownRequestCode, InvokeCallbackInvokesRegisteredCallback, InvokeCallbackConsumesRegisteredCallback, InvokeCallbackRemovesCallbackBeforePropagatingException, UnregisterActivityResultCallbackPreventsInvocation): PASS ✅ · 346s

(truncated to last 15,000 chars)

 'Category':'BoxView'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'RadioButton'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'WindowOverlay'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'ActivityIndicator'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Border'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Button'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'CheckBox'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'ContentView'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Element'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'DatePicker'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Dispatcher'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Editor'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Entry'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'FlowDirection'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'FlyoutView'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Fonts'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Graphics'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'GraphicsView'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Image'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'ImageButton'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'ImageSource'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'IndicatorView'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Label'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Layout'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Memory'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'NavigationPage'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Page'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Picker'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'ProgressBar'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'RefreshView'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'ScrollView'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'SearchBar'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'ShapeView'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Slider'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Stepper'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'SwipeView'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Switch'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Formatting'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Excluded test (filtered by Trait; 'Category':'TimePicker'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'View'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Window'): [TimePicker] Font Family Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'MauiContext'): [TimePicker] Font Size Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'Application'): [TimePicker] Font Size Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'BoxView'): [TimePicker] Font Size Initializes Correctly
      05-14 05:10:24.219 15662 15689 I DOTNET  : [FILTER] Included test (filtered by Trait; 'Category':'RadioButton'): [TimePicker] Font Size Initializes Correctly
      05-14 05:10:24.243 15662 15689 I DOTNET  : [Test environment: 64-bit .NET .NET 10.0 [collection-per-class, non-parallel]]
      05-14 05:10:24.243 15662 15689 I DOTNET  : [Test framework: xUnit.net 2.9.0.0]
      05-14 05:10:24.259 15662 15689 I DOTNET  : Test collection for Microsoft.Maui.DeviceTests.WebViewHandlerTests
      05-14 05:10:24.839 15662 15738 I DOTNET  : 	[PASS] Native View Bounding Box is not empty
      05-14 05:10:24.896 15662 15743 I DOTNET  : 	[PASS] Native View Bounding Box is not empty
      05-14 05:10:24.906 15662 15743 I DOTNET  : 	[PASS] Native View Bounding Box is not empty
      05-14 05:10:24.924 15662 15743 I DOTNET  : 	[PASS] Setting Semantic Hint makes element accessible
      05-14 05:10:24.925 15662 15743 I DOTNET  : 	[PASS] HandlersHaveAllExpectedContructors
      05-14 05:10:24.948 15662 15743 I DOTNET  : 	[PASS] RotationY Initialize Correctly
      05-14 05:10:24.974 15662 15749 I DOTNET  : 	[PASS] RotationY Initialize Correctly
      05-14 05:10:24.989 15662 15749 I DOTNET  : 	[PASS] RotationY Initialize Correctly
      05-14 05:10:25.033 15662 15749 I DOTNET  : 	[PASS] RotationY Initialize Correctly
      05-14 05:10:25.053 15662 15759 I DOTNET  : 	[PASS] Setting Semantic Description makes element accessible
      05-14 05:10:25.061 15662 15759 I DOTNET  : 	[PASS] TranslationY Initialize Correctly
      05-14 05:10:25.070 15662 15759 I DOTNET  : 	[PASS] TranslationY Initialize Correctly
      05-14 05:10:25.080 15662 15759 I DOTNET  : 	[PASS] Opacity is set correctly
      05-14 05:10:25.099 15662 15759 I DOTNET  : 	[PASS] Opacity is set correctly
      05-14 05:10:25.129 15662 15759 I DOTNET  : 	[PASS] NeedsContainerWhenInputTransparent
      05-14 05:10:25.137 15662 15759 I DOTNET  : 	[PASS] RotationX Initialize Correctly
      05-14 05:10:25.154 15662 15759 I DOTNET  : 	[PASS] RotationX Initialize Correctly
      05-14 05:10:25.189 15662 15766 I DOTNET  : 	[PASS] RotationX Initialize Correctly
      05-14 05:10:25.212 15662 15766 I DOTNET  : 	[PASS] DisconnectHandlerDoesntCrash
      05-14 05:10:25.250 15662 15771 I DOTNET  : 	[PASS] MinimumHeightInitializes
      05-14 05:10:25.257 15662 15771 I DOTNET  : 	[PASS] MinimumHeightInitializes
      05-14 05:10:25.265 15662 15771 I DOTNET  : 	[PASS] TranslationX Initialize Correctly
      05-14 05:10:25.274 15662 15771 I DOTNET  : 	[PASS] TranslationX Initialize Correctly
      05-14 05:10:25.359 15662 15776 I DOTNET  : 	[PASS] View Renders To Image
      05-14 05:10:25.375 15662 15776 I DOTNET  : 	[PASS] View Renders To Image
      05-14 05:10:25.384 15662 15776 I DOTNET  : 	[PASS] Rotation Initialize Correctly
      05-14 05:10:25.405 15662 15776 I DOTNET  : 	[PASS] Rotation Initialize Correctly
      05-14 05:10:25.406 15662 15776 I DOTNET  : 	[IGNORED] Semantic Hint is set correctly
      05-14 05:10:25.407 15662 15776 I DOTNET  : 	[IGNORED] Semantic Description is set correctly
      05-14 05:10:26.009 15662 15784 I DOTNET  : 	[PASS] ContainerView Adds And Removes
      05-14 05:10:26.292 15662 15822 I DOTNET  : 	[PASS] WebView loads non-Western character encoded URLs correctly
      05-14 05:10:26.311 15662 15822 I DOTNET  : 	[PASS] WebView loads non-Western character encoded URLs correctly
      05-14 05:10:26.320 15662 15822 I DOTNET  : 	[PASS] WebView loads non-Western character encoded URLs correctly
      05-14 05:10:26.320 15662 15822 I DOTNET  : 	[IGNORED] WebBrowser autoplays HTML5 Video
      05-14 05:10:26.360 15662 15822 I DOTNET  : 	[PASS] Null Semantics Doesnt throw exception
      05-14 05:10:26.452 15662 15822 I DOTNET  : 	[PASS] Visibility is set correctly
      05-14 05:10:26.501 15662 15822 I DOTNET  : 	[PASS] Visibility is set correctly
      05-14 05:10:26.539 15662 15822 I DOTNET  : 	[PASS] MinimumWidthInitializes
      05-14 05:10:26.550 15662 15822 I DOTNET  : 	[PASS] MinimumWidthInitializes
      05-14 05:10:26.661 15662 15822 I DOTNET  : 	[PASS] UrlSource Initializes Correctly
      05-14 05:10:26.694 15662 15822 I DOTNET  : 	[PASS] UrlSource Initializes Correctly
      05-14 05:10:26.762 15662 15822 I DOTNET  : 	[PASS] FlowDirection is set correctly
      05-14 05:10:26.769 15662 15822 I DOTNET  : 	[PASS] FlowDirection is set correctly
      05-14 05:10:26.807 15662 15840 I DOTNET  : 	[PASS] Clip Initializes ContainerView Correctly
      05-14 05:10:26.817 15662 15840 I DOTNET  : 	[PASS] ScaleY Initialize Correctly
      05-14 05:10:26.829 15662 15840 I DOTNET  : 	[PASS] ScaleY Initialize Correctly
      05-14 05:10:26.855 15662 15846 I DOTNET  : 	[PASS] ScaleY Initialize Correctly
      05-14 05:10:26.864 15662 15846 I DOTNET  : 	[PASS] Native View Bounds are not empty
      05-14 05:10:26.871 15662 15846 I DOTNET  : 	[PASS] Native View Bounds are not empty
      05-14 05:10:26.905 15662 15851 I DOTNET  : 	[PASS] Native View Bounds are not empty
      05-14 05:10:27.025 15662 15851 I DOTNET  : 	[PASS] Semantic Heading is set correctly
      05-14 05:10:27.036 15662 15851 I DOTNET  : 	[PASS] ScaleX Initialize Correctly
      05-14 05:10:27.047 15662 15851 I DOTNET  : 	[PASS] ScaleX Initialize Correctly
      05-14 05:10:27.053 15662 15851 I DOTNET  : 	[PASS] ContainerView Remains If Shadow Mapper Runs Again
      05-14 05:10:27.060 15662 15851 I DOTNET  : 	[PASS] Automation Id is set correctly
      05-14 05:10:27.077 15662 15851 I DOTNET  : 	[PASS] PlatformView Transforms are not empty
      05-14 05:10:27.086 15662 15851 I DOTNET  : 	[PASS] PlatformView Transforms are not empty
      05-14 05:10:27.090 15662 15851 I DOTNET  : Microsoft.Maui.DeviceTests.WebViewHandlerTests 2.4226765 ms
      05-14 05:10:27.093 15662 15851 I DOTNET  : Test collection for Microsoft.Maui.DeviceTests.ActivityResultCallbackRegistryTests
      05-14 05:10:27.127 15662 15851 I DOTNET  : 	[PASS] InvokeCallbackConsumesRegisteredCallback
      05-14 05:10:27.128 15662 15851 I DOTNET  : 	[PASS] UnregisterActivityResultCallbackPreventsInvocation
      05-14 05:10:27.128 15662 15851 I DOTNET  : 	[PASS] InvokeCallbackIgnoresUnknownRequestCode
      05-14 05:10:27.129 15662 15851 I DOTNET  : 	[PASS] InvokeCallbackRemovesCallbackBeforePropagatingException
      05-14 05:10:27.144 15662 15851 I DOTNET  : 	[PASS] InvokeCallbackInvokesRegisteredCallback
      05-14 05:10:27.145 15662 15851 I DOTNET  : Microsoft.Maui.DeviceTests.ActivityResultCallbackRegistryTests 0.0503155 ms
      05-14 05:10:27.293 15662 15689 I DOTNET  : Xml file was written to the provided writer.
      05-14 05:10:27.293 15662 15689 I DOTNET  : Tests run: 1325 Passed: 75 Inconclusive: 0 Failed: 0 Ignored: 1247
�[40m�[32minfo�[39m�[22m�[49m: <<XHARNESS_RESULT_START>>
      {
        "version": 1,
        "machineName": "runnervmfz4j5",
        "exitCode": 0,
        "exitCodeName": "SUCCESS",
        "platform": "android",
        "instrumentationExitCode": 0,
        "device": "emulator-5554",
        "deviceOsVersion": "API 30",
        "architecture": "x86_64",
        "files": [
          {
            "name": "testResults.xml",
            "type": "test-results"
          },
          {
            "name": "adb-logcat-com.microsoft.maui.core.devicetests-default.log",
            "type": "logcat"
          }
        ]
      }
      <<XHARNESS_RESULT_END>>
�[40m�[32minfo�[39m�[22m�[49m: Attempting to remove apk 'com.microsoft.maui.core.devicetests'..
�[40m�[37mdbug�[39m�[22m�[49m: Executing command: '/home/vsts/.nuget/packages/microsoft.dotnet.xharness.cli/11.0.0-prerelease.26230.4/runtimes/any/native/adb/linux/adb -s emulator-5554 uninstall com.microsoft.maui.core.devicetests'
�[40m�[32minfo�[39m�[22m�[49m: Successfully uninstalled com.microsoft.maui.core.devicetests
XHarness exit code: 0
  Tests completed successfully

📁 Fix files reverted (1 files)

• src/Core/src/Platform/Android/ActivityResultCallbackRegistry.cs

---

🧪 UI Tests — ViewBaseTests

Detected UI test categories: ViewBaseTests

✅ Deep UI tests — 118 passed, 0 failed across 1 category on platform-pool agent (replaces in-process counts above).

🧪 UI Test Execution Results (deep, platform pool)

Category	Tests	Snapshot diffs
controls-ViewBaseTests	118/119 ✓	—
📎 Download drop-deep-uitests artifact (TRX + snapshot diffs)

---

🔍 Pre-Flight — Context & Validation

Pre-Flight — PR #35436

Issue (#35405)

Title: Android WebView file chooser callbacks leak via ActivityResultCallbackRegistry

Root cause: MauiWebChromeClient.OnShowFileChooser registers an Action<Result, Intent> callback in the static ActivityResultCallbackRegistry dictionary for every WebView file chooser request. When the picker completes (success or cancel), MauiAppCompatActivity.OnActivityResult → ActivityResultCallbackRegistry.InvokeCallback runs the callback but never removes the entry. The captured closure roots the IValueCallback, so each completed/cancelled file chooser request leaks for the lifetime of the app.

Verified repro: Repro app AndroidWebViewFileChooserCallbackLeakRepro on AdamEssenmacher's fork shows Registry callbacks, Tracked live, and Weak refs alive growing after each cancelled picker even after forced GC. Issue labeled s/verified.

Affected platform: Android only.

PR (#35436) Summary

Author: AdamEssenmacher (community ✨, partner-flavored fix from the issue reporter).
State: Open, base main, head issue-35405, mergeable_state: blocked (likely waiting on CI / review).
Stats: 2 files changed, +115/−1.

Files changed

File	Type	Notes
src/Core/src/Platform/Android/ActivityResultCallbackRegistry.cs	Fix	1-line: TryGetValue → TryRemove inside InvokeCallback
src/Core/tests/DeviceTests/ActivityResultCallbackRegistryTests.Android.cs	Test (new)	5 xUnit device tests under [Category(TestCategory.WebView)]

PR's Fix (Candidate 0 — baseline)

-if (ActivityResultCallbacks.TryGetValue(requestCode, out callback))
+if (ActivityResultCallbacks.TryRemove(requestCode, out callback))

Atomically removes the registration before invoking it. Because s_nextActivityResultCallbackKey only ever increments and request codes are never re-used, no caller can depend on multi-invocation per request code; the semantic change is safe.

Tests added

ActivityResultCallbackRegistryTests.Android.cs (xUnit, [Category(TestCategory.WebView)]):

1. InvokeCallbackIgnoresUnknownRequestCode — no-op for unknown code.
2. InvokeCallbackInvokesRegisteredCallback — happy path.
3. InvokeCallbackConsumesRegisteredCallback — second InvokeCallback for same code does NOT re-invoke (proves removal).
4. InvokeCallbackRemovesCallbackBeforePropagatingException — removal happens before user callback runs, so an exception still leaves registry clean.
5. UnregisterActivityResultCallbackPreventsInvocation — explicit unregister still works.

Test type: device test (Microsoft.Maui.DeviceTests, net10.0-android). Gate passed: tests fail without the registry patch, pass with it.

Call sites of ActivityResultCallbackRegistry

Caller	Direction
MauiAppCompatActivity.Lifecycle.cs line 19	calls InvokeCallback from OnActivityResult
FormsAppCompatActivity.cs line 182 (Compatibility)	calls InvokeCallback from OnActivityResult
MauiWebChromeClient.cs	RegisterActivityResultCallback / UnregisterActivityResultCallback for file chooser
FormsWebChromeClient.cs (Compatibility)	same, for Forms WebView

No other registrars in tree. All registrants treat each call as one-shot — none re-invokes a request code. The PR fix is semantically safe across all current callers.

Edge cases / risk surface

• Re-entrancy: removing before invoke means a re-entrant call to InvokeCallback for the same code while the callback is running can't re-fire (good — current callers don't do this).
• Exception in callback: Test Aloha System.Maui! #4 documents that registry is cleaned regardless. Previously, an exception left the entry stranded too — but that's a separate issue.
• UnregisterCallbacks after invoke: MauiWebChromeClient.UnregisterCallbacks walks _requestCodes and calls UnregisterActivityResultCallback. After the fix this is a no-op (entry already removed). Behavior unchanged otherwise. _requestCodes list still accumulates request codes for the lifetime of the chrome client but only holds ints (no GC root for the IValueCallback).
• Compatibility WebView (FormsWebChromeClient): Same leak existed there too. PR fix in the central registry covers both call sites automatically. ✅
• Public API: No public API changes (PublicAPI.Unshipped.txt not modified, none needed). ✅
• Auto-generated files: Not touched. ✅

Impacted UI test categories

WebView — change is scoped to Android WebView file-chooser flow.

Classification

• Fix scope: Surgical (1 line + 5 unit-style device tests).
• Quality: Correct, minimal, thread-safe via ConcurrentDictionary.TryRemove.
• Tests: Adequate (cover happy path, one-shot, exception path, unknown code, explicit unregister). Pure runtime API tests — do not exercise actual WebView/file chooser, but the registry is the leak surface, so this is the right test level.
• CI gate: Already passed externally (tests fail w/o fix, pass with fix).

---

🔧 Fix — Analysis & Comparison

Try-Fix Aggregate — PR #35436

Issue: #35405 — Android WebView file chooser callbacks leak via ActivityResultCallbackRegistry.
Baseline (PR's fix, Candidate 0): 1-line change in ActivityResultCallbackRegistry.InvokeCallback from TryGetValue → TryRemove. Atomically removes the registry entry before invoking the callback. Gate ✅ PASSED (tests fail without fix, pass with fix).

The fix space for this bug is small. The leak is a one-line semantic bug in a static registry whose s_nextActivityResultCallbackKey is monotonically increasing — so no caller can observe the old "callback stays in dictionary" behavior in any meaningful way. Two non-trivial alternatives were explored:

#	Approach	File(s) changed	LOC delta	Leak fixed?	Test impact	Verdict
0	Baseline — TryGetValue → TryRemove in InvokeCallback	ActivityResultCallbackRegistry.cs	+1/−1	✅ All callers, present & future	All 5 PR tests pass	Ship
1	Caller-side self-unregister in MauiWebChromeClient (+ Forms) closure via try/finally	MauiWebChromeClient.cs, FormsWebChromeClient.cs	~+30	✅ in-tree, but whack-a-mole for future registrants	Breaks InvokeCallbackConsumesRegisteredCallback, InvokeCallbackRemovesCallbackBeforePropagatingException — they assert registry-level one-shot semantics this candidate doesn't provide	WORSE
2	Opt-in one-shot overload RegisterActivityResultCallback(callback, oneShot:true) + registry tracks per-entry flag	ActivityResultCallbackRegistry.cs, both WebChromeClients, both PR tests	~+30	✅ once both call sites opt in	Same two tests break unless updated to pass oneShot:true	WORSE

Why no Candidate 3?

The remaining variations are trivial (e.g., add an XML-doc warning; rename a parameter; reorder the TryRemove call) — none changes the fix's behavior. Per task guidance ("don't generate trivial variations"), the loop terminates here.

Recommendation

Ship the PR's baseline fix as-is.

Reasoning:

• Minimal surface (1 line) — smallest possible diff that fixes the class of bug.
• Atomic — ConcurrentDictionary.TryRemove is race-free; closure-side self-unregister (Candidate 1) leaves the slot occupied during user-code execution.
• Kills the entire regression class — any current or future caller of RegisterActivityResultCallback is automatically protected. Candidates 1 and 2 both keep "leak" as the default behavior, requiring vigilance from every future contributor adding a new activity-result use case (photo picker, biometric prompt, share sheet, etc.).
• Public API neutral — no PublicAPI.Unshipped.txt changes needed.
• Test parity — the PR's 5 device tests (under [Category(TestCategory.WebView)]) exercise the registry directly and cement the one-shot invariant. They are the right tests at the right level.
• Covers Compatibility — FormsWebChromeClient had the same leak; baseline fixes it transparently via the shared registry. Candidates 1 and 2 require editing the Compatibility file as well.

Optional nice-to-have (does not block merge): add an XML-doc note on InvokeCallback clarifying one-shot semantics for any future API spelunker. Not required.

---

Per-candidate details

See:

• try-fix-1/content.md — caller-side self-unregister approach (full diff + analysis)
• try-fix-2/content.md — opt-in one-shot overload approach (full diff + analysis)

---

📋 Report — Final Recommendation

Comparative Report — PR #35436

Issue: #35405 — Android WebView file chooser callbacks leak via ActivityResultCallbackRegistry.
Platform tested: android.
Gate: ✅ PASSED — regression tests FAIL without fix, PASS with fix.

Candidate slate

#	Candidate	Files changed	LOC	Fixes leak?	Regression tests	Notes
0	pr (baseline as submitted)	ActivityResultCallbackRegistry.cs (+1/-1); new ActivityResultCallbackRegistryTests.Android.cs (+114)	+115/-1	✅ all current + future callers	All 5 PR tests PASS	1-token semantic fix: TryGetValue → TryRemove.
0+	pr-plus-reviewer (PR + 3 reviewer edits)	Same files as pr + XML doc on InvokeCallback + 1 new atomicity test + tightened existing test assertion	+115/-1 + ~25 doc/test lines	✅ all current + future callers	All 5 PR tests PASS + new InvokeCallbackIsAtomicUnderConcurrentInvocation PASS	Strict superset of pr; documents one-shot contract; pins the atomicity invariant.
1	try-fix-1 caller-side self-unregister in both WebChromeClients via try/finally	MauiWebChromeClient.cs, FormsWebChromeClient.cs	~+30	✅ in-tree only (whack-a-mole for future callers)	InvokeCallbackConsumesRegisteredCallback FAIL, InvokeCallbackRemovesCallbackBeforePropagatingException FAIL — registry-level invariants no longer hold	Leaves leak-prone behavior in the registry; needs duplicated boilerplate in every future caller.
2	try-fix-2 opt-in oneShot:true overload + per-entry flag	ActivityResultCallbackRegistry.cs (struct wrapper + new overload), both WebChromeClients	~+30	✅ once call sites opt in	Same two tests FAIL as written unless rewritten to pass oneShot:true	Makes "leak" the default; preserves an unreachable contract (registration helpers are internal).

Scoring axes

Axis	pr	pr-plus-reviewer	try-fix-1	try-fix-2
Fixes #35405 end-to-end	✅	✅	✅	✅
Regression tests PASS as written	✅	✅	❌ (2 tests fail)	❌ (2 tests fail)
Protects future / external registrants from class	✅	✅	❌	❌
Atomic consume-on-invoke	✅	✅	❌ (slot held during user code)	✅ (when opt-in)
Remove-before-throw guarantee for free	✅	✅	Only if caller wraps try/finally	✅ (when opt-in)
Minimal diff	✅ (1 token)	✅ + small doc/test additions	❌ (~30 lines × 2 files)	❌ (new struct + new overload)
Public API behavior change documented	—	✅ XML doc	n/a	n/a
Atomicity-under-concurrent-invoke test	—	✅	—	—
Public API surface change	none	none	none	none
Behavior parity in Compatibility WebView	✅ (registry shared)	✅	requires duplicated patch (done)	requires duplicated opt-in (done)

Decision

Winner: pr-plus-reviewer.

Ranking (best → worst):

1. pr-plus-reviewer — strict superset of the PR's correct one-line fix, plus an XML doc that locks in the now-public one-shot contract and a concurrency test that pins the atomicity invariant the fix depends on. Gate tests still pass; adds one new passing test. No public API change, no behavioral risk vs pr.
2. pr — already correct, minimal, and gate-green. Loses to pr-plus-reviewer only on documentation/test-coverage polish.
3. try-fix-1 — caller-side self-unregister. Fails 2 of the PR's regression tests (asserts registry-level invariants that this approach explicitly does not provide). Solves the symptom for two known callers; leaves the class of leak alive for any future activity-result use case (photo picker, biometric, share sheet, custom intents). MUST rank below pr per the "regression-failing candidates rank lower" rule.
4. try-fix-2 — opt-in oneShot:true overload. Same regression-test failures as candidate 1 unless tests are rewritten to pass oneShot:true. Preserves a "back-compat" behavior that is unreachable through any public API today (registration helpers are internal). Makes "leak" the default for any future contributor. MUST also rank below pr per the gating rule.

The two try-fix candidates are functionally inferior on every meaningful axis to either form of the PR fix, and they explicitly fail the regression suite as written — making them ineligible to outrank either of the PR variants.

Between pr and pr-plus-reviewer, the reviewer edits carry zero downside risk (additive only), so pr-plus-reviewer is the recommended ship.

---