Make FormOrFieldsetsToFormData return false if form control not found

Bug: 849870
Change-Id: Ib51b8fbb51c107e4cd31910b4c342e8c2186402b
Reviewed-on: https://chromium-review.googlesource.com/1091462
Commit-Queue: Tao Bai <michaelbai@chromium.org>
Reviewed-by: Sebastien Seguin-Gagnon <sebsg@chromium.org>
Reviewed-by: Roger McFarlane <rogerm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#565678}

chrome/renderer/autofill/form_autofill_browsertest.cc

@@ -29,6 +29,7 @@
 #include "third_party/blink/public/web/web_form_element.h"
 #include "third_party/blink/public/web/web_input_element.h"
 #include "third_party/blink/public/web/web_local_frame.h"
+#include "third_party/blink/public/web/web_script_source.h"
 #include "third_party/blink/public/web/web_select_element.h"
 
 using autofill::features::kAutofillEnforceMinRequiredFieldsForHeuristics;
@@ -5333,5 +5334,39 @@ TEST_F(FormAutofillTest, FormCache_ExtractNewForms) {
   }
 }
 
+TEST_F(FormAutofillTest, WebFormElementNotFoundInForm) {
+  LoadHTML(
+      "<form id='form'>"
+      "  <input type='text' id='firstname' value='John'>"
+      "  <input type='text' id='lastname' value='John'>"
+      "</form>");
+
+  WebLocalFrame* frame = GetMainFrame();
+  ASSERT_NE(nullptr, frame);
+
+  WebFormElement web_form =
+      frame->GetDocument().GetElementById("form").To<WebFormElement>();
+  ASSERT_FALSE(web_form.IsNull());
+
+  WebFormControlElement control_element = frame->GetDocument()
+                                              .GetElementById("firstname")
+                                              .To<WebFormControlElement>();
+  ASSERT_FALSE(control_element.IsNull());
+  FormData form;
+  FormFieldData field;
+  EXPECT_TRUE(WebFormElementToFormData(web_form, control_element, nullptr,
+                                       EXTRACT_NONE, &form, &field));
+
+  const std::vector<FormFieldData>& fields = form.fields;
+  ASSERT_EQ(2U, fields.size());
+  EXPECT_EQ(ASCIIToUTF16("firstname"), fields[0].name);
+  EXPECT_EQ(ASCIIToUTF16("firstname"), field.name);
+
+  frame->ExecuteScript(
+      WebString("document.getElementById('firstname').remove();"));
+  EXPECT_FALSE(WebFormElementToFormData(web_form, control_element, nullptr,
+                                        EXTRACT_NONE, &form, &field));
+}
+
 }  // namespace form_util
 }  // namespace autofill

components/autofill/content/renderer/form_autofill_util.cc

@@ -1116,7 +1116,7 @@ void MatchLabelsAndFields(
 // or
 // 2) a NULL |form_element|.
 //
-// If |field| is not NULL, then |form_control_element| should be not NULL.
+// If |field| is not NULL, then |form_control_element| should not be NULL.
 bool FormOrFieldsetsToFormData(
     const blink::WebFormElement* form_element,
     const blink::WebFormControlElement* form_control_element,
@@ -1186,6 +1186,7 @@ bool FormOrFieldsetsToFormData(
   // the DOM.  We use the |fields_extracted| vector to make sure we assign the
   // extracted label to the correct field, as it's possible |form_fields| will
   // not contain all of the elements in |control_elements|.
+  bool found_field = false;
   for (size_t i = 0, field_idx = 0;
        i < control_elements.size() && field_idx < form_fields.size(); ++i) {
     // This field didn't meet the requirements, so don't try to find a label
@@ -1201,12 +1202,20 @@ bool FormOrFieldsetsToFormData(
     }
     TruncateString(&form_fields[field_idx]->label, kMaxDataLength);
 
-    if (field && *form_control_element == control_element)
+    if (field && *form_control_element == control_element) {
       *field = *form_fields[field_idx];
+      found_field = true;
+    }
 
     ++field_idx;
   }
 
+  // The form_control_element was not found in control_elements. This can
+  // happen if elements are dynamically removed from the form while it is
+  // being processed. See http://crbug.com/849870
+  if (field && !found_field)
+    return false;
+
   // Copy the created FormFields into the resulting FormData object.
   for (const auto& field : form_fields)
     form->fields.push_back(*field);