[Autofill] Added event for subframe navigation.

The event handler resets the iframe's AutofillHandler. This ensures that
unique renderer IDs are actually unique within AutofillHandler and
avoids false positive cache hits in the FormStructure cache.

Specifically, this concerns the FormRendererId for synthetic forms.
Without resetting the AutofillHandler, a pre-navigation synthetic
form cache entry persists and leads to false positives.

Bug: 1064709
Change-Id: Iface6ded3027c7b31322685122f2ea1fc8427607
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2120721
Commit-Queue: Christoph Schwering <schwering@google.com>
Reviewed-by: Vadym Doroshenko  <dvadym@chromium.org>
Cr-Commit-Position: refs/heads/master@{#776929}

components/autofill/content/browser/content_autofill_driver.cc

@@ -292,7 +292,7 @@ void ContentAutofillDriver::SelectFieldOptionsDidChange(const FormData& form) {
   autofill_handler_->SelectFieldOptionsDidChange(form);
 }
 
-void ContentAutofillDriver::DidNavigateMainFrame(
+void ContentAutofillDriver::DidNavigateFrame(
     content::NavigationHandle* navigation_handle) {
   if (navigation_handle->IsSameDocument())
     return;

components/autofill/content/browser/content_autofill_driver.h

@@ -117,9 +117,9 @@ class ContentAutofillDriver : public AutofillDriver,
   void DidEndTextFieldEditing() override;
   void SelectFieldOptionsDidChange(const FormData& form) override;
 
-  // Called when the main frame has navigated. Explicitely will not trigger for
-  // subframe navigations. See navigation_handle.h for details.
-  void DidNavigateMainFrame(content::NavigationHandle* navigation_handle);
+  // DidNavigateFrame() is called on the frame's driver, respectively, when a
+  // navigation occurs in that specific frame.
+  void DidNavigateFrame(content::NavigationHandle* navigation_handle);
 
   AutofillManager* autofill_manager() { return autofill_manager_; }
   AutofillHandler* autofill_handler() { return autofill_handler_.get(); }

components/autofill/content/browser/content_autofill_driver_factory.cc

@@ -132,18 +132,13 @@ void ContentAutofillDriverFactory::RenderFrameDeleted(
 
 void ContentAutofillDriverFactory::DidFinishNavigation(
     content::NavigationHandle* navigation_handle) {
-  // For the purposes of this code, a navigation is not important if it has not
-  // committed yet or if it's in a subframe.
-  if (!navigation_handle->HasCommitted() ||
-      !navigation_handle->IsInMainFrame()) {
-    return;
+  if (navigation_handle->HasCommitted() &&
+      (navigation_handle->IsInMainFrame() ||
+       navigation_handle->HasSubframeNavigationEntryCommitted())) {
+    NavigationFinished();
+    DriverForFrame(navigation_handle->GetRenderFrameHost())
+        ->DidNavigateFrame(navigation_handle);
   }
-
-  // A main frame navigation has occured. We suppress the autofill popup and
-  // tell the autofill driver.
-  NavigationFinished();
-  DriverForFrame(navigation_handle->GetRenderFrameHost())
-      ->DidNavigateMainFrame(navigation_handle);
 }
 
 void ContentAutofillDriverFactory::OnVisibilityChanged(

components/autofill/content/browser/content_autofill_driver_unittest.cc

@@ -282,7 +282,7 @@ class TestContentAutofillDriver : public ContentAutofillDriver {
     return static_cast<MockAutofillManager*>(autofill_manager());
   }
 
-  using ContentAutofillDriver::DidNavigateMainFrame;
+  using ContentAutofillDriver::DidNavigateFrame;
 };
 
 class ContentAutofillDriverTest : public content::RenderViewHostTestHarness {
@@ -316,7 +316,7 @@ class ContentAutofillDriverTest : public content::RenderViewHostTestHarness {
     content::MockNavigationHandle navigation_handle(GURL(), main_rfh());
     navigation_handle.set_has_committed(true);
     navigation_handle.set_is_same_document(same_document);
-    driver_->DidNavigateMainFrame(&navigation_handle);
+    driver_->DidNavigateFrame(&navigation_handle);
   }
 
  protected: