Make form submissions cancel client navigations

When a form submission is scheduled, this patch will make it so any
attempt to navigate the target frame which was already sent to the
browser process will be canceled in order to make the form submission
take precedence over it.

This is the same behavior that would occur if we had synchronous form
submissions - a synchronous form submission would cancel any navigations
already sent to the browser process.

Bug: 1091583
Change-Id: I6c8421922960e3209fcc21a7e4582e0fbf7d4bb4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2254443Reviewed-by: Nate Chapin <japhet@chromium.org>
Commit-Queue: Joey Arhar <jarhar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#782084}

third_party/blink/renderer/core/exported/web_frame_test.cc

@@ -13350,4 +13350,31 @@ TEST_F(WebFrameTest, FocusElementCallsFocusedElementChanged) {
   EXPECT_TRUE(frame_host.did_notify_);
 }
 
+// Tests that form.submit() cancels any navigations already sent to the browser
+// process.
+TEST_F(WebFrameTest, FormSubmitCancelsNavigation) {
+  frame_test_helpers::TestWebFrameClient web_frame_client;
+  frame_test_helpers::WebViewHelper web_view_helper;
+  web_view_helper.Initialize(&web_frame_client);
+  RegisterMockedHttpURLLoad("foo.html");
+  RegisterMockedHttpURLLoad("bar.html");
+  auto* main_frame = web_view_helper.GetWebView()->MainFrameImpl();
+  auto* local_frame = main_frame->GetFrame();
+  auto* document = local_frame->GetDocument();
+
+  document->documentElement()->setInnerHTML(
+      "<form id=formid action='http://internal.test/bar.html'></form>");
+  ASSERT_FALSE(local_frame->Loader().HasProvisionalNavigation());
+
+  FrameLoadRequest request(document,
+                           ResourceRequest("http://internal.test/foo.html"));
+  local_frame->Navigate(request, WebFrameLoadType::kStandard);
+  ASSERT_TRUE(local_frame->Loader().HasProvisionalNavigation());
+
+  main_frame->ExecuteScript(WebScriptSource(WebString("formid.submit()")));
+  EXPECT_FALSE(local_frame->Loader().HasProvisionalNavigation());
+
+  RunPendingTasks();
+}
+
 }  // namespace blink

third_party/blink/renderer/core/html/forms/html_form_element.cc

@@ -514,6 +514,11 @@ void HTMLFormElement::ScheduleFormSubmission(
     // Cancel pending javascript url navigations for the target frame. This new
     // form submission should take precedence over them.
     target_local_frame->GetDocument()->CancelPendingJavaScriptUrls();
+
+    // Cancel any pre-existing attempt to navigate the target frame which was
+    // already sent to the browser process so this form submission will take
+    // precedence over it.
+    target_local_frame->Loader().CancelClientNavigation();
   }
 
   target_frame->ScheduleFormSubmission(scheduler, form_submission);