[iOS] Fix a crash in PasswordManager::OnIframeDetach.

Fixes a crash for a case, when a successful submission is detected
on iframe detach and a corresponding PasswordFormManager is moved
while iterating through a vector of password form managers.

Bug: 1129758
Change-Id: I03d8f41d2ee0dc599389385726e2f7f8c4d4b299
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2418956
Commit-Queue: Maria Kazinova <kazinova@google.com>
Reviewed-by: Jan Wilken Dörrie <jdoerrie@chromium.org>
Cr-Commit-Position: refs/heads/master@{#808831}

components/password_manager/core/browser/password_manager.cc

@@ -743,7 +743,7 @@ void PasswordManager::OnPasswordFormRemoved(
       manager->SetDriver(driver->AsWeakPtr());
     // Find a form with corresponding renderer id.
     if (manager->DoesManageAccordingToRendererId(form_id, driver)) {
-      CheckForPotentialSubmission(manager.get(), field_data_manager, driver);
+      DetectPotentialSubmission(manager.get(), field_data_manager, driver);
       return;
     }
   }
@@ -754,9 +754,12 @@ void PasswordManager::OnIframeDetach(
     PasswordManagerDriver* driver,
     const FieldDataManager* field_data_manager) {
   for (auto& manager : form_managers_) {
-    // Find a form with corresponding frame id.
-    if (manager->observed_form()->frame_id == frame_id) {
-      CheckForPotentialSubmission(manager.get(), field_data_manager, driver);
+    // Find a form with corresponding frame id. Stop iterating in case the
+    // target form manager was found to avoid crbug.com/1129758 and since only
+    // one password form is being submitted at a time.
+    if (manager->observed_form()->frame_id == frame_id &&
+        DetectPotentialSubmission(manager.get(), field_data_manager, driver)) {
+      return;
     }
   }
 }
@@ -1241,7 +1244,7 @@ AutofillAssistantMode PasswordManager::GetAutofillAssistantMode() const {
 }
 
 #if defined(OS_IOS)
-void PasswordManager::CheckForPotentialSubmission(
+bool PasswordManager::DetectPotentialSubmission(
     PasswordFormManager* form_manager,
     const FieldDataManager* field_data_manager,
     PasswordManagerDriver* driver) {
@@ -1254,8 +1257,13 @@ void PasswordManager::CheckForPotentialSubmission(
     form_manager->ProvisionallySave(*form_manager->observed_form(), driver,
                                     nullptr);
   }
-  if (form_manager->is_submitted())
+  // If the manager was set to be submitted, either prior to this function call
+  // or on provisional save above, consider submission successful.
+  if (form_manager->is_submitted()) {
     OnLoginSuccessful();
+    return true;
+  }
+  return false;
 }
 #endif
 

components/password_manager/core/browser/password_manager.h

@@ -334,7 +334,7 @@ class PasswordManager : public PasswordManagerInterface {
   // could still be provisionally saved on user input or have autofilled data,
   // in this case submission might be considered successful and a save prompt
   // might be shown.
-  void CheckForPotentialSubmission(
+  bool DetectPotentialSubmission(
       PasswordFormManager* form_manager,
       const autofill::FieldDataManager* field_data_manager,
       PasswordManagerDriver* driver);