Invalidate the page state when restoring WebUIs

components/sessions/content/content_serialized_navigation_driver.cc

Index: components/sessions/content/content_serialized_navigation_driver.cc
diff --git a/components/sessions/content/content_serialized_navigation_driver.cc b/components/sessions/content/content_serialized_navigation_driver.cc
index a3305a8695311157429112f3677d91fa124daac5..b164f8eb5934b6817abc6c7cf7370cc7ee171728 100644
--- a/components/sessions/content/content_serialized_navigation_driver.cc
+++ b/components/sessions/content/content_serialized_navigation_driver.cc
@@ -103,6 +103,12 @@ void ContentSerializedNavigationDriver::Sanitize(
       content::Referrer::SanitizeForRequest(navigation->virtual_url_,
                                             old_referrer);
 
+  // Clear any WebUI page state.
+  if (navigation->virtual_url_.SchemeIs(content::kChromeUIScheme) &&
+      navigation->original_request_url_.SchemeIs(content::kChromeUIScheme)) {
+    navigation->encoded_page_state_ = std::string();
+  }
+
   // No need to compare the policy, as it doesn't change during
   // sanitization. If there has been a change, the referrer needs to be
   // stripped from the page state as well.